PartnerStack

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:25 AM UTC
• Version: 1.0.2

Overview

The skill is coherent for PartnerStack automation, but its fallback setup tells users or agents to run unverified remote installer scripts directly in a shell.

Install only if you are comfortable using OOMOL as the intermediary for PartnerStack and with the listed read/write actions. If the oo CLI is not already installed, avoid the one-line shell installers unless you can verify the installer through an official, trusted method first; approve any customer-creation payload before it runs.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61
• Finding: Unverified Remote Installation Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 61–65 **Vulnerability Type**: Unverified remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable scripts from an external server and immediately pass their contents to a command interpreter. The downloaded files are not pinned to a specific release and are not validated using a cryptographic signature or published checksum before execution. Consequently, the code that is ultimately executed can differ from the content available when the skill was audited. Although the URLs use HTTPS and appear associated with the declared OOMOL service, HTTPS alone does not protect against compromise of the distribution server, its deployment pipeline, or trusted signing infrastructure. The Linux command also follows redirects, allowing the final payload location to differ from the displayed URL. The instructions are presented as conditional first-time setup steps rather than normal connector operation, but installation is not part of the minimum privileges needed once the declared CLI is available. Executing an unverified installer grants the remote payload the full permissions of the user running the agent or command. ### Attack Path 1. The `oo` CLI is absent, causing a command to fail with `oo: command not found`. 2. The agent or user follows the first-time setup instructions in `SKILL.md`. 3. An attacker compromises the installation endpoint, its release pipeline, or another component capable of controlling the returned content. 4. The endpoint returns attacker-controlled shell or PowerShell code. 5. `bash` or `Invoke-Expression` executes the response without inspection or integrity verification. 6. ...[truncated 827 chars]
• Remediation: ## Remediation Suggestions - Remove direct `curl | bash` and `Invoke-RestMethod | Invoke-Expression` installation patterns. - Direct users to a pinned, versioned release from a verifiable official distribution channel. - Download the installer or binary to a local file without executing it immediately. - Publish a SHA-256 or stronger checksum through an independently protected channel and verify it before execution. - Prefer cryptographic release signatures and validate the signature against a documented, pinned publisher key. - Avoid unreviewed redirects, or validate the final download origin against an explicit allowlist. - Provide package-manager installation instructions where the package repository authenticates releases and supports version pinning. - Display the downloaded script for review before execution when a script-based installer is unavoidable. - Keep installation a manual, explicitly approved operation. The skill should not automatically install software in response to a failed connector command. - Run installation with a non-privileged account and request only the filesystem and execution permissions strictly required by the CLI.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 92% confidence
• Finding: The skill instructs the agent/user to install software by piping a remotely fetched script directly into `bash`, which is a well-known unsafe pattern because it executes whatever the server returns without prior verification. In this skill context, the command appears in a fallback setup path rather than the main action flow, which slightly reduces likelihood, but it still creates a high-risk supply-chain and remote-code-execution path if the install endpoint, network path, or hosting account is compromised.

Static analysis

No suspicious patterns detected.