ProxiedMail

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:13 AM UTC
• Version: 1.0.3

Overview

The ProxiedMail skill is mostly clear and purpose-aligned, but its first-time setup tells users to execute remote installer scripts directly, which warrants Review before installation.

Before installing, review the oo CLI installation path carefully. Prefer an official, versioned, signed, or checksum-verified installer instead of piping a live remote script directly into a shell. Once installed and connected, the skill can read ProxiedMail email data and create or update proxy bindings, so only use it with an account where that access is intended.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59
• Finding: Unpinned Remote Shell Script Download and Execution## Vulnerability Details **File Location**: `SKILL.md`, line 59 **Vulnerability Type**: Remote payload retrieval and execution through a shell pipeline **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The setup instructions pipe a remotely retrieved, mutable script directly into `bash`. The downloaded payload is not pinned to a specific release and is not authenticated through a cryptographic signature or verified checksum. The pipeline also prevents the user from reviewing the exact script before it executes. Installing the CLI may be a legitimate prerequisite for the declared ProxiedMail functionality, but directly executing the latest remote script exceeds the minimum behavior necessary to perform that installation. The same objective can be achieved using a versioned artifact with integrity validation. The use of HTTPS protects the network connection under normal conditions but does not protect against compromise of the installer host, its deployment pipeline, DNS or certificate infrastructure, or the vendor account controlling the script. Because the effective payload can change after the skill has been reviewed, the safety of this instruction cannot be established solely from the audited project. ### Attack Path 1. An attacker compromises `cli.oomol.com`, the installer publishing process, or another component capable of changing the response for `/install.sh`. 2. The attacker replaces or modifies the installation script with arbitrary shell commands. 3. A user or agent encounters an `oo: command not found` error and follows the documented setup instruction. 4. `curl` downloads the attacker-controlled response. 5. The shell pipeline immediately passes the response to `bash` without integrity verification or review. 6. The malicious commands execute with the privileges and environment of the user who invoked the comman ...[truncated 725 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `curl | bash` pipeline. - Direct users to a versioned CLI release hosted in the project's official release repository. - Pin the installer or binary to a specific reviewed version rather than an unversioned “latest” script. - Publish a SHA-256 or stronger checksum through a separately protected channel and require verification before execution. - Prefer cryptographically signed packages or binaries and document signature verification. - Separate download and execution so users can inspect the artifact before running it. - Prefer trusted operating-system package managers where packages are signed and repository metadata is authenticated. - If an installer script remains necessary, use a hardened sequence such as downloading to a newly created local file, validating its checksum or signature, inspecting it, and only then executing it without unnecessary elevation.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63
• Finding: Unpinned Remote PowerShell Script Download and Execution## Vulnerability Details **File Location**: `SKILL.md`, line 63 **Vulnerability Type**: Remote payload retrieval and execution through PowerShell **Risk Level**: High **Vulnerable Code**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows setup instruction uses `Invoke-RestMethod` (`irm`) to retrieve a mutable PowerShell script and pipes its contents directly to `Invoke-Expression` (`iex`). This causes the remote response to be interpreted as PowerShell code immediately, without version pinning, signature validation, checksum verification, or an opportunity for inspection. Installing the CLI is related to the skill's stated operation, but executing mutable remote code is not the least-privileged or least-risk installation mechanism. The instruction delegates effective control of local code execution to the current contents of the remote URL, including any future modifications made after this skill was audited. HTTPS does not mitigate a compromised hosting service, vendor publishing account, build pipeline, or certificate and DNS infrastructure. PowerShell code running in the current session can interact with the filesystem, processes, network, registry, and user-accessible credential stores subject to the invoking account's permissions. ### Attack Path 1. An attacker gains the ability to alter the script served from `https://cli.oomol.com/install.ps1` or otherwise control the authenticated response. 2. The attacker embeds arbitrary PowerShell commands in the response. 3. A Windows user or agent follows the first-time installation instructions after the `oo` command is unavailable. 4. `Invoke-RestMethod` retrieves the attacker-controlled content. 5. The pipeline sends the response directly to `Invoke-Expression`. 6. PowerShell executes the payload in the user's session with the invoking user's privileges. ### Impact Assessment Successful ...[truncated 706 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm ... | iex` installation pattern. - Distribute a versioned and cryptographically signed PowerShell script, MSI, or executable through an official release channel. - Require Authenticode signature validation or verification of a securely published cryptographic checksum before execution. - Pin instructions to a specific reviewed release instead of a mutable URL. - Download the artifact to disk first and execute it only after successful integrity and publisher verification. - Prefer a trusted Windows package manager with authenticated metadata and signed packages. - Document that installation should use ordinary user privileges unless elevation is demonstrably required. - Ensure installation failures do not trigger automatic execution of remote code without explicit user awareness and approval.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users to install software by piping a remotely fetched script directly into a shell (`curl ... | bash`). This creates a supply-chain and remote code execution risk: if the install endpoint, transport, hosting, or upstream release process is compromised, arbitrary code will execute immediately on the user's machine without inspection or integrity verification.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger description is extremely broad: it directs use of this skill for ANY ProxiedMail request and to prefer it over direct API use. Broad routing language can cause unintended invocation in contexts the user did not explicitly request, increasing the chance of unnecessary access to connected account data or accidental state-changing operations. In a skill that can read and update mailbox-related resources, this makes misrouting more dangerous than in a purely informational skill.

Static analysis

No suspicious patterns detected.