Pilvio

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:03 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a coherent Pilvio data-reading helper, but its first-time setup tells users or agents to run an unverified internet installer directly in a shell.

Review the setup path before installing. Normal Pilvio read operations through an already installed `oo` CLI are narrowly scoped, but do not run the documented installer commands unless you trust OOMOL's installer source and are comfortable executing a remote script on your machine. Prefer a verified or package-manager installation path if available.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59
• Finding: Unverified Remote Installer Download and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 59–63 **Vulnerability Type**: Remote payload retrieval and execution through pipe-to-shell installation commands **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from `cli.oomol.com` and immediately execute them using `bash` or PowerShell's `Invoke-Expression`. Neither command pins a release version, verifies a cryptographic signature or checksum, nor gives the user an opportunity to inspect the downloaded content before execution. Although the download domain appears related to the declared OOMOL service, the effective code executed by these commands is controlled remotely and can change after the Skill has been reviewed. Compromise of the hosting service, release pipeline, DNS/TLS infrastructure, or installer content could consequently result in arbitrary code execution. Installing a CLI may be necessary when the required command is unavailable, but unverified pipe-to-shell execution exceeds the minimum privileges needed for the Skill's declared read-only Pilvio operations. The issue is partially constrained because the instructions say to use installation only after an `oo: command not found` error. ### Attack Path 1. The Skill attempts to perform a Pilvio operation using the `oo` CLI. 2. The command fails because `oo` is not installed. 3. The agent or user follows the documented first-time setup instructions. 4. The system retrieves the current installer from `https://cli.oomol.com/install.sh` or `https://cli.oomol.com/install.ps1`. 5. The downloaded response is passed directly to `bash` or `Invoke-Expression` without integrity verification. 6. If the remote installer or its delivery infrastructure has been compromised, attacker-contr ...[truncated 738 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove both direct pipe-to-shell installation patterns. 2. Prefer an official package manager or a version-pinned release artifact from the publisher's official repository. 3. Download the installer as a separate file rather than executing the network response directly. 4. Publish an expected SHA-256 or stronger cryptographic digest through an independently trusted channel and verify it before execution. 5. Where supported, verify a publisher signature and validate the signing identity. 6. Display or otherwise permit inspection of the installer before execution. 7. Require explicit user approval before installing software, even when the `oo` command is missing. 8. Run the installer with ordinary user privileges and avoid elevation unless a clearly documented installation step strictly requires it. 9. Pin the documented installer or CLI version so that the reviewed artifact corresponds to the artifact users receive. 10. Preserve the existing behavior of attempting normal connector operations first, and present safe manual installation instructions only after a confirmed missing-command error. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs the agent to install software by piping a remotely fetched script directly into a shell, which creates a supply-chain and remote code execution risk if the host, network path, or served script is compromised. Because this appears in an operational skill, an automated agent may execute it during fallback handling, turning a documentation shortcut into actual code execution on the user's machine.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The description says to use this skill for "ANY Pilvio request" and whenever a task involves Pilvio, which is a very broad activation condition. It does not provide boundaries, exclusions, or negative examples to clarify when the skill should not be invoked.

Static analysis

No suspicious patterns detected.