Photoroom

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:40 AM UTC
• Version: 1.0.2

Overview

The skill mostly matches its Photoroom connector purpose, but its first-time setup tells users to execute remote installer scripts directly, which is high-impact and not sufficiently controlled.

Review this skill before installing. Use it only if you are comfortable with OOMOL's Photoroom connector workflow, and avoid running the documented remote installer one-liners as-is; prefer a trusted package source or download, verify, inspect, and run the installer separately without elevated privileges.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:55
• Finding: Unverified Remote Installer Download and Immediate Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:55-61` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from `cli.oomol.com` and immediately execute them through Bash or PowerShell. Neither command pins a specific installer version nor verifies a cryptographic signature or checksum before execution. Piping a network response directly into a command interpreter also prevents meaningful inspection of the exact payload before it runs. Installing the `oo` CLI supports the Skill's declared Photoroom connector functionality, and the download domain is consistent with the declared OOMOL provider. However, direct remote execution exceeds the minimum privileges necessary for safely distributing installation instructions because the installer could instead be downloaded, authenticated, inspected, and then executed separately. The reviewed file does not establish that the current remote installer is malicious; the vulnerability is that its effective code can change after the Skill has been audited. ### Attack Path 1. The `oo` command is unavailable, causing the Agent or user to follow the first-time setup instructions. 2. The shell requests `install.sh` or `install.ps1` from the remote OOMOL host. 3. An attacker compromises the hosting infrastructure, publishing pipeline, DNS/TLS trust path, or another mechanism capable of controlling the returned response. 4. The attacker supplies a modified installer containing arbitrary commands. 5. Bash or PowerShell executes the response immediately, without version pinning, signature verification, checksum validation, or prior review. 6. The malicious commands run with the privileges of the user or Age ...[truncated 1114 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace pipe-to-interpreter installation commands with a version-pinned package or release artifact from an authenticated distribution channel. 2. Download the installer to a local file without executing it: ```bash curl --fail --show-error --location --output install.sh \ "https://example.invalid/releases/v1.0.2/install.sh" ``` 3. Publish a cryptographic checksum and preferably a signed release manifest through an independent or strongly authenticated channel. 4. Verify the downloaded artifact before execution: ```bash echo "<EXPECTED_SHA256> install.sh" | sha256sum --check - ``` 5. Allow the user or Agent to inspect the saved installer before running it, then execute it as a separate step with the minimum required privileges: ```bash bash install.sh ``` 6. Apply the same controls to the PowerShell installer using a pinned artifact and `Get-FileHash`, followed by separate execution only after successful verification. 7. Prefer a trusted operating-system package manager or a signed platform-native package where available. 8. Document that installation must not be performed from an elevated shell unless a specific, justified operation requires elevation. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill recommends installing software via a direct remote-script pipe to the shell (`curl ... | bash`), which executes code fetched at runtime without integrity verification or user review. If the install endpoint, network path, or hosting account were compromised, an operator could be induced to run arbitrary code on their machine under the guise of first-time setup.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use this skill for "ANY Photoroom request," including reading, creating, and updating data. That trigger scope is very broad and lacks exclusion conditions or negative examples, which could cause the skill to be invoked for loosely related mentions of Photoroom rather than clearly bounded tasks.

Static analysis

No suspicious patterns detected.