PlanetScale

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:11 AM UTC
• Version: 1.0.3

Overview

This PlanetScale skill is mostly coherent, but its setup instructions include risky one-line remote installers that execute downloaded code immediately.

Install only if you trust OOMOL's CLI distribution path and are comfortable connecting a PlanetScale account. Prefer installing the oo CLI through a verified package or inspecting and verifying the installer before execution, and require explicit confirmation before creating or deleting PlanetScale databases or branches.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64

Finding

Unverified Remote Installer Download and Immediate Shell Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64-68
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions download mutable scripts from cli.oomol.com and pass their contents directly to bash or PowerShell's Invoke-Expression. The scripts are executed without version pinning, checksum verification, publisher-signature validation, or an opportunity for local inspection.

Consequently, the code executed during installation is not fixed to the content reviewed in this audit. Although the hostname appears associated with the stated OOMOL CLI, compromise of the distribution server, its release process, or the relevant DNS/TLS trust chain could replace the installer with arbitrary code.

Installing software this way also crosses the Skill's declared runtime boundary of Bash(oo *): the documented runtime functionality only needs an existing oo executable, while setup permits an unrestricted shell to execute externally supplied commands.

Attack Path

1. The oo command is absent, causing the first-time setup instructions to apply.
2. An Agent or user runs the provided curl | bash or irm | iex command.
3. The remote host or its delivery chain serves a malicious or compromised installer.
4. The shell executes the response immediately without authenticating its contents.
5. The payload performs arbitrary actions under the privileges of the invoking account.

Impact Assessment

A malicious installer obtains arbitrary command execution with the invoking user's privileges. It could read or alter user-accessible files, steal locally available credentials, modify executables or configuration, install persistence, o ...[truncated 295 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove direct curl | bash and irm | iex installation commands.
2. Prefer an established, platform-native package manager with package signing and a pinned package version.
3. If direct installation is necessary, pin an immutable release and official artifact URL rather than a mutable installer endpoint.
4. Download the artifact to a local file without executing it.
5. Verify a publisher signature and a checksum obtained through an independently authenticated channel.
6. Inspect the downloaded artifact or use a locally reviewed installer before invoking it as a separate command.
7. Run installation with the least-privileged account possible and avoid administrative elevation unless strictly required.
8. Keep installation outside normal Skill execution and continue requiring the Skill itself to invoke only the constrained oo command surface.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill includes a shell one-liner that fetches a remote script and pipes it directly to bash, which executes unverified code from the network. If the install endpoint, transport, hosting, or upstream supply chain is compromised, an attacker could achieve arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest instructs the agent to use this skill for ANY PlanetScale request, which is an overly broad routing trigger. That can cause the skill to be invoked for sensitive or destructive database tasks by default, increasing the chance that powerful operations are selected without sufficient task-specific scrutiny or narrower intent matching.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.