Opsgenie

• Outcome: Review
• Latest audit: Sep 15, 2026 · 6:01 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent for Opsgenie operations, but it includes an unsafe remote installer command and can acknowledge alerts without the confirmation required for other state-changing actions.

Review before installing. Use a safer, verified oo CLI installation method instead of running the pasted remote shell commands, and require explicit confirmation before acknowledging, closing, or creating Opsgenie alerts. Ensure the connected Opsgenie API key is limited to the scopes and teams this skill should manage.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61
• Finding: Unverified Remote Installer Is Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 61–65 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The setup instructions pipe content downloaded from remote URLs directly into Bash or PowerShell. The downloaded scripts are mutable external resources whose effective contents cannot be established from the reviewed project. Neither command pins an installer version nor verifies a cryptographic signature or checksum before execution. Consequently, compromise of the hosting service, deployment infrastructure, domain account, or installer itself could cause arbitrary commands to execute. HTTPS protects transport integrity but does not protect against a compromised or malicious origin. Installing the required CLI is relevant to the skill's functionality, but immediately executing an unverified network response is not the minimum privilege or minimum-risk mechanism necessary to install it. ### Attack Path 1. An attacker compromises the installer host, its publishing pipeline, or the remote installer content. 2. The `oo` command is unavailable, causing the user or agent to consult the first-time setup instructions. 3. The documented `curl | bash` or `irm | iex` command downloads the attacker's current payload. 4. The shell executes the payload immediately, without an opportunity to inspect it or verify its provenance. 5. The payload performs arbitrary actions with the privileges of the shell process. If the installer requests elevation and the user approves it, the resulting scope may increase. ### Impact Assessment A malicious installer can execute arbitrary commands with the invoking user's privileges. This can permit access to files, environment variables, local application crede ...[truncated 355 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace direct shell pipelines with a version-pinned package or downloadable release artifact. - Download the installer to a local file and require inspection before execution. - Publish a SHA-256 or stronger checksum through an independently protected channel and verify it before running the artifact. - Prefer cryptographic signature verification using a documented, pinned publisher key. - Require explicit user approval before installing software or executing an installer. - Run installation with ordinary user privileges unless a specific operation demonstrably requires elevation. - Document the exact files, commands, network endpoints, and permission changes performed by the installer. - For managed environments, recommend a trusted package manager or administrator-provisioned installation instead of an arbitrary remote script. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39
• Finding: State-Changing Alert Acknowledgement Is Misclassified as a Safe Read Action<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 39–50 **Vulnerability Type**: Insecure skill configuration and authorization workflow **Risk Level**: Medium ### Vulnerable Code ```markdown - `acknowledge_alert` — Acknowledge an Opsgenie alert and return the asynchronous request ID. - `close_alert` — Close an Opsgenie alert and return the asynchronous request ID. [write] - `create_alert` — Create an Opsgenie alert and return the asynchronous request ID. [write] - `get_alert` — Get one Opsgenie alert by ID, tiny ID, or alias. - `get_current_account` — Validate the Opsgenie API key and return account information for the key. - `get_request_status` — Get processing status for an Opsgenie asynchronous alert request. - `list_alerts` — List Opsgenie alerts with query, saved-search, sorting, and paging filters. ## Safety - Untagged actions are reads (get / list / search) — safe to run directly. - **Actions tagged `[write]` change Opsgenie state — confirm the exact payload and effect with the user before running.** ``` ### Technical Analysis `acknowledge_alert` changes the state of an Opsgenie alert, but it is not marked with the `[write]` tag. The safety policy explicitly classifies all untagged actions as reads that are safe to execute directly. This inconsistency allows alert acknowledgement to bypass the confirmation requirement applied to other state-changing operations. The issue does not provide new operating-system privileges, but it causes the skill to exercise existing Opsgenie write authority without the intended user authorization checkpoint. ### Attack Path 1. A request or ambiguous instruction concerns an existing Opsgenie alert. 2. The agent selects `acknowledge_alert`. 3. Because the action is untagged, the skill's safety rules classify it as safe to run directly. 4. The agent submits the acknowledgement through the OOMOL Opsgenie connector without confirming the alert identifier, payload, or state change. 5. Opsgenie reco ...[truncated 612 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Mark `acknowledge_alert` explicitly as `[write]`. - Require confirmation of the exact alert identifier, acknowledgement payload, and expected effect before invoking the action. - Replace the implicit rule that every untagged action is read-only with an explicit allowlist of read-only actions. - Treat unknown, newly introduced, or unclassified connector actions as state-changing by default. - Fetch and inspect the live action schema before execution, as already required elsewhere in the skill. - Present the resulting asynchronous request ID to the user and, when appropriate, verify completion with `get_request_status`. - Add a review or automated validation rule ensuring every action that mutates remote state carries the appropriate safety tag. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs the agent to install software via a remote script piped directly to shell (`curl ... | bash`), which is a classic supply-chain and arbitrary code execution risk. If the remote host, transport, or script is compromised, the agent could execute attacker-controlled code on the local system with the current user's privileges.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use this skill for "ANY Opsgenie request" and whenever a task involves Opsgenie, which is a very broad activation condition. It does not define boundaries, exclusions, or narrower trigger examples, increasing the chance of unintended invocation for loosely related requests.

Static analysis

No suspicious patterns detected.