Planhat

• Outcome: Review
• Latest audit: Sep 15, 2026 · 6:16 AM UTC
• Version: 1.0.3

Overview

The skill is transparent about operating Planhat, but it includes high-impact remote installer commands and broad Planhat access, so users should review it before installing.

Install only if you are comfortable granting the oo CLI access to your OOMOL-connected Planhat workspace. Confirm all write payloads carefully, and prefer a verified or package-manager-based oo CLI installation path instead of running the provided curl-to-bash or irm-to-iex commands directly.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote Shell Script Execution on macOS and Linux## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High **Complete Code Snippet**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The first-time setup instructions retrieve a mutable script from an external URL and pipe it directly into Bash. The downloaded content is not pinned to a version or immutable artifact, and no cryptographic signature or checksum is verified before execution. Installing the required CLI is related to the Skill's declared functionality, and the documented step is only intended to run after an `oo: command not found` error. However, direct `curl | bash` execution exceeds the minimum privilege necessary to download an installer because it gives the remote response immediate code-execution authority under the invoking user's account. HTTPS protects the connection in transit but does not protect against compromise of the vendor's domain, DNS, web server, CDN, publishing credentials, or installation pipeline. Because the response is executed without review, the effective payload can change after this Skill has been audited. ### Attack Path 1. The `oo` CLI is absent and an attempted connector command fails. 2. The user or agent follows the documented first-time setup instruction. 3. An attacker who has compromised the vendor's delivery infrastructure causes `https://cli.oomol.com/install.sh` to return a modified shell script. 4. `curl` sends the response directly to Bash without integrity verification. 5. The malicious script executes with the permissions of the invoking user. ### Impact Assessment Successful exploitation permits arbitrary command execution within the invoking user's privilege boundary. The payload could read or alter accessible files, steal environment variables or locally available credentials, modify shell config ...[truncated 176 chars]
• Remediation: ## Remediation Suggestions - Replace the pipe-to-shell command with installation from a version-pinned, immutable release artifact. - Download the artifact to a local file without executing it immediately. - Publish and require verification of a SHA-256 digest and, preferably, a signature rooted in a documented publisher key. - Present the verified script for inspection before execution. - Run installation with ordinary user privileges unless a narrowly defined operation specifically requires elevation. - Pin the expected CLI version and document a controlled upgrade process. - If an installer script remains necessary, fail closed when signature or checksum validation cannot be completed.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66
• Finding: Unverified Remote PowerShell Script Execution on Windows## Vulnerability Details **File Location**: `SKILL.md`, line 66 **Vulnerability Type**: Remote payload retrieval and immediate PowerShell execution **Risk Level**: High **Complete Code Snippet**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows setup instruction uses `Invoke-RestMethod` to retrieve a mutable PowerShell script and passes the response directly to `Invoke-Expression`. This causes externally controlled text to be interpreted as PowerShell code immediately, without version pinning, signature validation, checksum verification, or local inspection. Although installing the CLI supports the declared functionality and is documented as a conditional first-time step, immediate `iex` execution grants the remote endpoint more authority than is required merely to obtain an installer. The reviewed Skill cannot guarantee what code this URL will serve later. ### Attack Path 1. The `oo` CLI is unavailable on a Windows system. 2. The user or agent follows the documented PowerShell setup command. 3. An attacker compromises the vendor's domain, delivery service, publishing account, or related infrastructure. 4. The endpoint supplies attacker-controlled PowerShell code. 5. `Invoke-Expression` executes that code immediately with the invoking process's permissions. ### Impact Assessment Successful exploitation enables arbitrary PowerShell execution as the current user. An attacker could access user-readable files and credentials, alter profile scripts or application configuration, establish persistence, invoke additional system utilities, or retrieve further malware. Execution from an elevated PowerShell session could result in system-wide compromise.
• Remediation: ## Remediation Suggestions - Replace `irm ... | iex` with installation from a versioned, immutable release artifact. - Save the installer locally before execution. - Require Authenticode signature validation and a separately published cryptographic checksum. - Reject unsigned installers, invalid signatures, hash mismatches, and unexpected publisher identities. - Avoid elevated PowerShell sessions unless installation demonstrably requires narrowly scoped administrative operations. - Pin the CLI version and document explicit review and upgrade procedures. - Prefer a trusted package manager with publisher verification where available.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 94% confidence
• Finding: The skill instructs users to install the CLI via a remote script piped directly into a shell, which executes code fetched over the network without prior verification. If the distribution endpoint, DNS, TLS trust chain, or hosting environment is compromised, this becomes arbitrary code execution on the user's machine.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger text says to use this skill for ANY Planhat request and whenever a task involves Planhat, which is broad enough to cause automatic invocation on casual mentions or loosely related tasks. In an agent setting, that increases the chance of unnecessary access to connected SaaS data and unintended execution of read or write operations without the narrowest possible tool selection.

Static analysis

No suspicious patterns detected.