People Data Labs

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:05 AM UTC
• Version: 1.0.3

Overview

The skill largely does what it claims, but it needs review because setup can execute an unverified remote installer and People Data Labs queries may send personal or company data through OOMOL without explicit safeguard instructions.

Install only if you trust OOMOL's CLI distribution and are comfortable with People Data Labs query payloads being processed through OOMOL. Prefer verifying or manually inspecting the installer before running it, and review any JSON payload or file input before sending personal, confidential, or regulated data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:53
• Finding: Unverified Remote Installation Scripts Executed Directly by Shells<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 53–63 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```markdown - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The installation instructions download mutable content from an external URL and immediately execute it using Bash or PowerShell. Neither command pins a specific release nor verifies a cryptographic signature or checksum before execution. Although installing the `oo` CLI is relevant when the command is unavailable, direct execution of an unverified remote script is not the minimum-risk installation method. The effective installer payload can change after the Skill has been reviewed. Consequently, compromise of the OOMOL publication infrastructure, hosting account, DNS resolution, TLS termination, or installer build process could turn these instructions into an arbitrary-code execution channel. The PowerShell `irm ... | iex` instruction has the same trust-boundary problem as the Bash `curl ... | bash` instruction. ### Attack Path 1. The Agent attempts to use the Skill and receives an `oo: command not found` error. 2. The Agent follows the first-time setup instructions. 3. The Agent downloads the current contents of `install.sh` or `install.ps1`. 4. The response is passed directly to Bash or PowerShell without local inspection or integrity verification. 5. If the remote delivery or publication system has been compromised, attacker-controlled commands execute with the privileges of the user running the Agent. 6. The payload can then access user-readable files, alter local tools or configuration, install persistence where permissions permit, or do ...[truncated 567 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | bash` and `irm | iex` installation patterns. 2. Pin installation instructions to a specific, audited CLI release rather than a mutable installer endpoint. 3. Download the installer or release artifact to a local file without executing it. 4. Verify the artifact using a vendor signature and a SHA-256 checksum obtained through an independently trusted channel. 5. Prefer a trusted package manager or signed release package with explicit version constraints. 6. Show the proposed version, source, checksum, and installation effects to the user and obtain explicit approval before execution. 7. Run installation with ordinary user privileges unless elevated privileges are demonstrably required. 8. Document what files, environment settings, and network endpoints the installer modifies. ]]>

other

Warning

• Location: SKILL.md:25
• Finding: Privacy-Sensitive Person and Company Data Transmitted Through an Intermediary Without Explicit Data-Handling Safeguards<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 25–43 **Vulnerability Type**: Privacy-sensitive data transmission **Risk Level**: Medium ### Vulnerable Code ```markdown **1. Inspect the contract** to get the authoritative input/output schema before building a payload: ```bash oo connector schema "peopledatalabs" --action "<action_name>" ``` **2. Run the action** with a JSON payload that matches the input schema: ```bash oo connector run "peopledatalabs" --action "<action_name>" --data '<json>' --json ``` - `--data` takes a JSON object string or `@path/to/file.json`; omit it to send `{}`. - The response is `{ "data": ..., "meta": { "executionId": "..." } }`; the execution id lives under `meta.executionId`. ## Available actions - `enrich_company` — Match a single company in People Data Labs and return the top matched company record. - `enrich_person` — Match a single person in People Data Labs and return the top matched person record. - `search_companies` — Search the People Data Labs company dataset with either an Elasticsearch query or SQL query. - `search_people` — Search the People Data Labs person dataset with either an Elasticsearch query or SQL query. ``` ### Technical Analysis The Skill sends JSON query payloads through the OOMOL `oo` connector to perform People Data Labs searches and enrichment. Person enrichment and search payloads can include names, email addresses, telephone numbers, employment information, locations, or other identifying data. Using the intermediary is disclosed and is inherent to this Skill's connector-based architecture. However, the instructions do not require explicit user confirmation before transmitting personal data, define allowed fields, require data minimization, prohibit sending secrets or unnecessary sensitive attributes, or document retention and logging implications. The behavior therefore creates a privacy and confidentiality risk rather than evidence of covert exfiltration. The Skill ...[truncated 1315 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Clearly disclose that query payloads are processed through OOMOL before reaching People Data Labs. 2. Require explicit user confirmation before transmitting personal, confidential, or otherwise sensitive information. 3. Construct payloads using only fields required by the live action schema and the user's stated request. 4. Prohibit inclusion of passwords, authentication tokens, financial data, health data, government identifiers, and unrelated conversation context. 5. Avoid using `@path/to/file.json` with files whose full contents have not been reviewed and approved for transmission. 6. Redact or pseudonymize identifiers when exact values are unnecessary. 7. Document applicable retention, logging, deletion, geographic processing, and privacy controls for both OOMOL and People Data Labs. 8. Provide a payload preview and identify all external recipients before sending high-sensitivity queries. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software via `curl ... | bash`, which downloads and immediately executes a remote script without verification. If the hosting endpoint, transport, or upstream distribution is compromised, this can lead to arbitrary code execution on the user's machine.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use this skill for "ANY People Data Labs request," which is a very broad activation condition without scope limits or exclusion examples. This can cause unintended invocation for loosely related mentions of People Data Labs rather than clearly defined task types.

Static analysis

No suspicious patterns detected.