Open Exchange Rates

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:04 AM UTC
• Version: 1.0.3

Overview

The skill is coherent for Open Exchange Rates access, but its setup instructions tell users to run unverified remote installer scripts directly in a shell.

Review the first-time setup before installing. Prefer installing the oo CLI through a trusted, versioned, verifiable package or by downloading and inspecting the installer first. For normal use after setup, the skill appears limited to Open Exchange Rates connector actions through OOMOL.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59

Finding

Unverified Remote Installation Scripts Executed Directly by Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–63
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions download mutable scripts from an external server and pass the responses directly to Bash or PowerShell. Neither command allows the user to inspect the downloaded content before execution, and no version pinning, cryptographic signature verification, or checksum validation is performed.

Consequently, the code that executes can differ from the content available when the Skill was audited. Compromise of the hosting service, publishing account, DNS resolution, or TLS trust chain could turn these installation commands into an arbitrary-code-execution channel. Although installing the oo CLI supports the declared connector functionality, executing an unverified network response directly in a shell exceeds the minimum mechanism necessary to perform that installation.

Attack Path

1. The oo CLI is unavailable, causing the user or agent to follow the first-time setup instructions.
2. An attacker compromises or otherwise gains control over the remote installation response or its delivery path.
3. The attacker modifies install.sh or install.ps1 to include malicious commands.
4. The setup command retrieves the modified response and immediately pipes it to Bash or Invoke-Expression.
5. The malicious commands execute with the privileges of the user running the installation command, without a review or integrity-verification step.

Impact Assessment

Successful exploitation permits arbitrary command execution under the invoking user's account. The resulting access could allow an attacker to read or modify files available to that account, ...[truncated 760 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the direct curl | bash and irm | iex installation patterns.
• Prefer an official operating-system package manager with signed repository metadata and a version-pinned package.
• If a standalone artifact is required, download it to a local file without executing it automatically.
• Pin the download to a specific release version rather than a mutable generic installation URL.
• Publish and verify a cryptographic signature from a separately trusted signing key. At minimum, verify a release-specific SHA-256 digest obtained through an independent trusted channel.
• Allow the user to inspect the downloaded installer before execution.
• Require explicit user approval before installing software, and clearly state which files, directories, and system settings the installer will modify.
• Run installation with ordinary user privileges whenever possible; request elevated privileges only for a narrowly defined operation that genuinely requires them.
• Document a manual installation procedure and provide rollback or uninstall instructions.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill recommends curl ... | bash to install the CLI, which executes a remote script directly without verification. If the hosting domain, transport path, or script contents are compromised, a user or agent could run arbitrary code on the local system with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description instructs use of this skill for ANY Open Exchange Rates request and instead of calling the API directly, which is an overly broad routing rule. This can cause unintended activation for casual mentions of Open Exchange Rates and may steer an agent into executing commands or querying connected services when the user only wanted discussion or comparison.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.