Owl Protocol

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:08 AM UTC
• Version: 1.0.3

Overview

The skill is mostly coherent for using Owl Protocol through OOMOL, but its fallback setup tells users or agents to run unverified remote installer scripts directly in a shell.

Install only if you are comfortable with OOMOL/Owl Protocol access and avoid running the pasted remote installer commands automatically. Prefer installing oo through a verified, versioned method from the vendor, review what will be installed, and require explicit confirmation before any patch_project_token write action.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:55

Finding

Unverified Remote Installation Scripts Are Executed Directly

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55-62
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

markdown

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
  irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell
  ```

Technical Analysis

The installation instructions retrieve mutable scripts from external URLs and immediately execute them through Bash or PowerShell. They provide no version pinning, cryptographic signature verification, checksum validation, or review step.

HTTPS authenticates and encrypts the transport connection but does not ensure that the script remains identical to the version assessed during this audit. Compromise of the hosting account, web server, CDN, DNS resolution chain, TLS termination infrastructure, or upstream build pipeline could replace the installer after the Skill has been reviewed.

The installation behavior is not required for normal connector operations because the Skill states that users should ordinarily have the CLI installed already. Although installation is limited to a command-not-found fallback, directing an Agent to execute an unverified remote script exceeds the minimum privilege necessary to document that prerequisite.

Attack Path

1. The oo CLI is absent, causing a command to fail with oo: command not found.
2. The Agent or user follows the documented first-time setup instructions.
3. An attacker who has compromised the remote script host or its delivery chain replaces install.sh or install.ps1 with a malicious payload.
4. curl | bash or irm | iex executes the changed payload immediately without integrity verification or inspection.
5. The payload runs with all privileg ...[truncated 747 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both direct execution pipelines.
2. Pin installation instructions to a specific reviewed CLI release rather than a mutable installer endpoint.
3. Download the release artifact without executing it, then verify a vendor-published cryptographic signature or a checksum obtained through an independently authenticated channel.
4. Display the exact version, source, destination, and expected changes, and require explicit user approval before installation.
5. Prefer a trusted platform package manager where packages are signed and repository metadata is authenticated.
6. Execute installation with ordinary user privileges unless a specific, documented operation requires elevation.
7. Apply equivalent verification controls to both the Bash and PowerShell installation paths.
8. If a script remains necessary, use a sequence such as download, signature verification, local inspection, and explicit execution rather than piping network output directly into an interpreter.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29

Finding

Shell Command Template Permits Injection Through JSON Payloads

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29-31
Vulnerability Type: Shell command injection
Risk Level: Medium

Vulnerable Code

bash

oo connector run "owl_protocol" --action "<action_name>" --data '<json>' --json

Technical Analysis

The documented command places a generated JSON payload inside a single-quoted shell argument. JSON strings may legitimately contain apostrophes. If an Agent substitutes JSON containing an attacker-controlled apostrophe directly into this template, that character terminates the shell quote. Subsequent shell metacharacters can then be interpreted as commands instead of data.

For example, a malicious metadata value structured to contain an apostrophe followed by a command separator could close the --data argument, execute an additional local command, and comment out or otherwise neutralize the remainder. JSON serialization alone does not make a value safe for interpolation into shell source because JSON escaping and shell escaping are different mechanisms.

This risk is particularly relevant to patch_project_token, where metadata may originate from user-supplied or externally sourced content. The Skill allows only Bash(oo *), which reduces direct tool scope, but the unsafe template can make shell parsing occur within an apparently permitted oo command.

Attack Path

1. An attacker supplies or influences a metadata value used in an Owl Protocol action.
2. The value includes an apostrophe and shell control syntax.
3. The Agent serializes the value as JSON and substitutes it literally for <json> in the documented command.
4. The apostrophe closes the shell argument surrounding --data.
5. The shell interprets the remaining attacker-controlled text as command syntax.
6. The injected command executes locally with the privileges and accessible environment of the Agent process.

Impact Assessment

Exploitation can produce ...[truncated 542 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not interpolate JSON into shell command text.
2. Serialize the payload with a trusted JSON library into a newly created, permission-restricted temporary file.
3. Pass that file through the supported syntax:

   bash

   oo connector run "owl_protocol" --action "ACTION_NAME" --data @/secure/path/payload.json --json
   

4. Create temporary files securely, restrict permissions to the current user, avoid predictable names, and delete them after use.
5. Prefer launching oo through a process API that accepts an argument array and does not invoke a shell.
6. Validate action names against the connector's enumerated schema rather than accepting arbitrary shell text.
7. Treat metadata and all user- or network-derived fields as untrusted, even after JSON serialization.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The skill instructs the agent to install a CLI by piping a remotely fetched script directly into a shell (curl ... | bash). This is dangerous because it executes unverified code from the network with the user's privileges, creating a supply-chain and remote code execution risk if the host, transport, or distribution pipeline is compromised.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Static analysis

No suspicious patterns detected.