PDFMonkey

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:12 AM UTC
• Version: 1.0.3

Overview

This PDFMonkey skill is mostly coherent, but its first-time setup tells users or agents to run unverified remote installer scripts directly in a shell.

Use the skill only if you are comfortable with OOMOL as an intermediary for PDFMonkey actions. Do not run the documented installer pipe-to-shell commands automatically; install the oo CLI from a trusted, versioned source and verify the installer or package before execution. Confirm any write action payload before creating PDFMonkey documents.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61

Finding

Unverified Remote Installer Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61–65
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

The first-time setup instructions download mutable scripts from remote OOMOL endpoints and immediately execute them in the user's shell:

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

Both installation commands pass remotely retrieved content directly to a command interpreter. The downloaded scripts are not pinned to a specific release, inspected before execution, or verified using a cryptographic signature or hard-coded checksum.

HTTPS provides transport security but does not establish that the retrieved script is an immutable, reviewed artifact. If the hosting server, publishing account, DNS/control plane, TLS termination infrastructure, or installer pipeline is compromised, the endpoint can return arbitrary commands. Those commands will execute with all privileges available to the user running the installation.

This installation mechanism is not necessary for the Skill's declared PDFMonkey functionality. The normal connector interface is restricted to Bash(oo *), but the setup procedure crosses that boundary by allowing an external party to define arbitrary shell or PowerShell commands at execution time. The documentation states that setup should only be used after a command failure, which reduces routine exposure but does not eliminate the execution risk.

The audit found no evidence that the current remote scripts are malicious. The vulnerability arises from executing mutable, unverified remote content.

Attack Path

1. A threat actor compromises the installer host, publishing credentials, deployment pipeline, DNS/control plane, or another component capable of changing responses from cli.oomol.com.
2. The ...[truncated 1566 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | bash and irm | iex installation patterns.
2. Direct users to a versioned release artifact from an authenticated official release channel.
3. Pin the installation instructions to an explicit CLI version rather than a mutable installer endpoint.
4. Download the artifact to disk without executing it automatically.
5. Publish platform-specific SHA-256 checksums through a separately protected release process and require verification before installation.
6. Prefer operating-system package signing or a verifiable publisher signature in addition to checksum validation.
7. Display the exact artifact version, source, expected checksum, and installation effect before requesting explicit user approval.
8. Do not permit an agent to install the dependency automatically after a command failure; require a deliberate user-controlled setup step.
9. Run installation with standard user privileges unless elevated privileges are strictly required and separately approved.
10. Document how users can inspect the downloaded artifact and verify its provenance before execution.

A safer Unix-like workflow should follow this model:

bash

curl -fL -o oo-cli.tar.gz "https://trusted.example/releases/oo-cli-VERSION.tar.gz"
echo "PINNED_SHA256  oo-cli.tar.gz" | sha256sum --check -
# Install only after successful verification and explicit user approval.

Equivalent PowerShell instructions should use Invoke-WebRequest to save a versioned artifact, validate it with Get-FileHash, verify any available publisher signature, and execute it only after explicit approval.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill instructs users to install software via 'curl ... | bash', which executes a remote script directly from the network without prior verification. If the install endpoint, transport path, or hosting account is compromised, this can lead to arbitrary code execution on the user's machine under their account.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description uses an expansive activation condition covering any request involving PDFMonkey, without narrowing contexts or giving exclusion examples. This can cause unintended invocation for casual mentions or tasks where direct API usage might still be appropriate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.