Plane

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:55 AM UTC
• Version: 1.0.2

Overview

The skill is coherent for managing Plane through OOMOL, but its setup instructions include unverified remote installer commands that could execute arbitrary code.

Review the installer path before using this skill. Prefer installing the oo CLI through a verified package, pinned release, checksum, or signature-checked installer, and only approve Plane write or delete actions after confirming the exact target and payload.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:65
• Finding: Unverified Remote Shell Script Execution via curl and Bash## Vulnerability Details **File Location**: `SKILL.md`, line 65 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation command downloads a mutable script from an external URL and pipes it directly into Bash. The remote content is executed immediately without version pinning, checksum verification, cryptographic signature validation, or an opportunity for local inspection. Although installation is presented as a fallback for a missing `oo` CLI, installing software is more privileged than the skill's declared Plane connector operations. The repository does not contain the downloaded script, so its effective behavior cannot be established by auditing this project alone. If the hosting domain, server, DNS path, TLS termination, or release process is compromised, the returned script could be changed after this skill has been reviewed. ### Attack Path 1. The `oo` command is absent or appears unavailable. 2. The agent or user follows the documented first-time setup procedure. 3. `curl` retrieves the current contents of `https://cli.oomol.com/install.sh`. 4. The response body is sent directly to Bash without integrity or authenticity verification. 5. Any commands in the response execute with the privileges of the user running the skill. 6. A compromised payload could access files, credentials, environment variables, or network resources available to that user and could attempt additional persistence or privilege escalation. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. The accessible scope may include the user's files, local credentials, environment variables, authenticated CLI state, and network-accessible services. If run from a privileged account, the impact could extend to system-wide modification. The i ...[truncated 205 chars]
• Remediation: ## Remediation Suggestions - Do not pipe downloaded content directly into a shell. - Prefer a signed package from an official platform package manager or a version-pinned release artifact. - Download the installer to a local file first and verify a publisher-provided cryptographic signature or pinned SHA-256 digest before execution. - Pin the installer and CLI to a reviewed immutable version rather than an unversioned endpoint. - Present the verified file and intended changes to the user and require explicit approval before installation. - Run installation with the least-privileged account possible and avoid requesting administrative privileges unless demonstrably required. - Document the expected files, permissions, and network endpoints used by the installer so its behavior can be independently reviewed.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:69
• Finding: Unverified Remote PowerShell Script Execution via Invoke-Expression## Vulnerability Details **File Location**: `SKILL.md`, line 69 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis This command retrieves mutable PowerShell content from an external URL with `Invoke-RestMethod` (`irm`) and immediately evaluates it with `Invoke-Expression` (`iex`). No fixed version, checksum, Authenticode signature check, or local review step is required. The executable payload is not included in the audited project and can change independently after review. Consequently, trust in this instruction depends entirely on the continued security of the external hosting and software delivery process. Direct use of `iex` removes the separation between downloading and executing content, making a malicious or compromised response an immediate code-execution event. ### Attack Path 1. The `oo` CLI is missing or appears unavailable on a Windows host. 2. The agent or user follows the documented PowerShell setup command. 3. `Invoke-RestMethod` downloads the current response from `https://cli.oomol.com/install.ps1`. 4. The response is piped directly to `Invoke-Expression`. 5. PowerShell evaluates all returned commands with the invoking user's privileges. 6. If the delivery source or payload is compromised, attacker-controlled commands can operate on resources accessible to that PowerShell session. ### Impact Assessment Exploitation permits arbitrary PowerShell execution as the current user. Potentially exposed resources include user documents, stored credentials, environment variables, authenticated application state, and reachable network services. If PowerShell is running elevated, the payload could make system-wide changes. No such secondary behavior is present in the reviewed file itself; the risk arises because unrestricted, externally controlled code is executed with ...[truncated 17 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm ... | iex` execution pattern. - Distribute a version-pinned installer with a valid Authenticode signature from a verified publisher. - Download the installer separately, save it locally, and verify both its signature and a published cryptographic digest before running it. - Require explicit user approval after displaying the installer source, version, verification result, and expected system changes. - Execute the installer with standard-user privileges unless elevation is strictly necessary and separately approved. - Prefer a trusted Windows package manager with publisher verification and immutable version selection. - Maintain auditable release provenance and document the installer's expected file, registry, and network operations.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software via a remote script piped directly into bash, which executes unverified code from the network without prior inspection or integrity validation. If the distribution endpoint, transport, or upstream script is compromised, this becomes an immediate arbitrary code execution path on the user's machine.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest description says to use this skill for ANY Plane request and instead of calling the API directly, which is an overly broad routing trigger. This can cause the agent to invoke the skill in situations it should not, including sensitive or destructive Plane operations without enough task-specific gating, increasing the chance of unintended actions.

Static analysis

No suspicious patterns detected.