Perdoo

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:03 AM UTC
• Version: 1.0.3

Overview

This is a Perdoo connector skill, but it needs Review because it can change Perdoo data through a broad GraphQL action and recommends running an online installer directly.

Install only if you are comfortable giving the OOMOL-connected Perdoo account access to read and update Perdoo data. Before any GraphQL mutation or update, require the agent to show the exact operation, variables, target objects, and expected effect. Avoid running the documented pipe-to-shell installer unless you have independently verified the oo CLI installation source or can use a safer official install method.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:55
• Finding: Unverified Remote Installation Scripts Executed Directly by the Shell## Vulnerability Details **File Location**: `SKILL.md`, lines 55-63 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```bash - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis Both installation commands retrieve mutable content from an external server and immediately execute it in Bash or PowerShell. The instructions provide no version pinning, cryptographic signature verification, checksum validation, or locally auditable copy of the installer. HTTPS protects the connection in transit but does not establish that the downloaded script is safe. A compromise of the hosting server, publishing account, DNS infrastructure, or installer deployment process could change the effective payload after this Skill has been reviewed. Installing the required CLI is related to the declared functionality, and the instructions only recommend installation after an `oo: command not found` failure. However, direct pipe-to-shell execution exceeds the minimum privilege and trust necessary to install a command-line client because it gives a mutable remote response immediate code-execution authority. ### Attack Path 1. The Agent attempts to use the Skill and receives an `oo: command not found` error. 2. It follows the documented first-time setup instructions. 3. Bash retrieves `https://cli.oomol.com/install.sh`, or PowerShell retrieves `https://cli.oomol.com/install.ps1`. 4. The downloaded response is passed directly to an interpreter without inspection or integrity verification. 5. If the hosting or delivery infrastructure is compromised, the substituted script executes arbitrary attacker-controlled commands under the invoking user's account. 6. The payload may th ...[truncated 716 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `curl | bash` and `irm | iex` installation instructions. - Prefer a trusted operating-system package manager or an official package repository with package-signing enforcement. - Pin the CLI to a specific, reviewed release rather than executing the latest mutable installer. - If a standalone artifact is necessary, download it without executing it, verify a publisher signature and a documented SHA-256 or stronger digest, and only then install it. - Require explicit user approval before installing software. - Document the files, permissions, and network access required by the installer. - Avoid elevated execution unless it is demonstrably necessary; install into a user-scoped location where possible. - Preserve a locally auditable or version-linked installer so the reviewed payload cannot change after publication.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:36
• Finding: Untagged GraphQL Mutation Capability Bypasses Write Confirmation Policy## Vulnerability Details **File Location**: `SKILL.md`, lines 36-46 **Vulnerability Type**: Inconsistent authorization and confirmation policy for state-changing operations **Risk Level**: High ```markdown Each action is listed below with a one-line description; actions that change state carry a `[write]` or `[destructive]` tag. Before constructing `--data`, fetch the action's live schema with `oo connector schema` to get its authoritative input fields. ## Available actions - `execute_graphql` — Execute a JSON-friendly Perdoo GraphQL query or mutation. - `get_goal` — Retrieve one Perdoo goal by UUID. - `list_goals` — List Perdoo goals with the documented GraphQL goal filters and cursor pagination. - `upsert_commit` — Create or update a Perdoo progress update for exactly one goal, key result, or KPI. [write] ## Safety - Untagged actions are reads (get / list / search) — safe to run directly. - **Actions tagged `[write]` change Perdoo state — confirm the exact payload and effect with the user before running.** - **Actions tagged `[destructive]` remove or overwrite data — always confirm the target and get explicit approval first.** ``` ### Technical Analysis The `execute_graphql` action explicitly supports both GraphQL queries and mutations, but it is not tagged as `[write]` or `[destructive]`. The Skill simultaneously states that untagged actions are reads and are safe to execute directly. This creates a policy inconsistency: a state-changing GraphQL mutation can be submitted through an action that the safety section classifies as read-only. Consequently, the action can bypass the explicit confirmation required for other write operations such as `upsert_commit`. Fetching the live schema does not resolve this issue because schema inspection validates payload structure rather than the user's authorization of a specific mutation. The safe behavior must depend on the GraphQL operation type and its effects, not solely on the action-level tag. ### Attack Path ...[truncated 1240 chars]
• Remediation: ## Remediation Suggestions - Mark `execute_graphql` as `[write]` because it is capable of executing mutations. - Prefer splitting the capability into separately permissioned actions, such as `execute_graphql_query` and `execute_graphql_mutation`. - Require explicit user confirmation whenever the parsed GraphQL operation type is `mutation`, regardless of action-level metadata. - Before confirmation, display the exact mutation, variables, target objects, and expected effects. - Treat unknown, malformed, multi-operation, or dynamically constructed GraphQL documents as state-changing by default. - Apply server-side enforcement so mutation execution cannot rely solely on natural-language Skill instructions. - Restrict the connector to the minimum Perdoo scopes required for the documented actions. - Add automated tests ensuring every state-changing path triggers confirmation, including mutations submitted through generic GraphQL actions.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 95% confidence
• Finding: The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (`curl ... | bash`). This creates a supply-chain and remote code execution risk: if the remote host, network path, or install script is compromised, arbitrary code would run immediately on the user's machine or execution environment without verification.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The invocation guidance is excessively broad: 'Use this skill for ANY Perdoo request' can cause an agent to route all Perdoo-related tasks through this skill without evaluating whether the request is appropriate, least-privilege, or safe. In agent ecosystems, overbroad routing increases the chance of unintended tool use, including writes, because merely mentioning Perdoo may trigger connector access.

Static analysis

No suspicious patterns detected.