Push by Techulus

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:53 AM UTC
• Version: 1.0.3

Overview

The skill is a coherent Push by Techulus connector, but its setup instructions include unverified remote installer commands that could execute arbitrary local code.

Review the setup path before installing. Prefer installing the oo CLI from a verified, pinned, signed, or package-manager source instead of running the pasted curl-to-bash or PowerShell execution commands. For notification actions, confirm the exact recipients and message payload before allowing the skill to send anything.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:53
• Finding: Unverified Remote Installation Scripts Executed Directly by Shell## Vulnerability Details **File Location**: `SKILL.md`, lines 53–61 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical The first-time setup instructions execute remotely hosted installation scripts directly in Bash or PowerShell: ```markdown - **`oo: command not found`** — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis Both installation commands retrieve mutable executable content from `cli.oomol.com` and immediately pass it to a command interpreter. Neither procedure pins an installer version, validates a cryptographic checksum or digital signature, saves the script for inspection, nor verifies its expected contents before execution. HTTPS protects the connection in transit but does not establish that the remote script remains identical to the version intended when this Skill was audited. Compromise of the hosting infrastructure, publishing account, deployment pipeline, or signing process—or an unintended future change to the script—could cause arbitrary commands to be executed without requiring any modification to this repository. The installation mechanism is conditional on the `oo` command being unavailable, which reduces invocation frequency but does not remove the execution risk. Installing a CLI may be relevant to the declared functionality, but piping an unverified response directly into a shell is not the minimum privilege or safest mechanism necessary to perform that installation. ### Attack Path 1. A user requests a Push by Techulus operation through the Skill. 2. The attempted `oo` command fails because the CLI is not installed. 3. The Agent or user follows the documented first-time setup procedure. 4. `curl` or `Invoke- ...[truncated 1234 chars]
• Remediation: ## Remediation Suggestions 1. Remove both direct download-to-interpreter patterns: - Do not use `curl ... | bash`. - Do not use `irm ... | iex`. 2. Prefer an official operating-system package manager or a trusted, signed package repository. 3. Pin installation to a specific CLI version rather than downloading a mutable default installer. 4. If a standalone installer is necessary: - Download it to a local file without executing it. - Obtain an expected SHA-256 or stronger digest from an independently protected release channel. - Verify the digest before execution. - Verify a platform-appropriate digital signature where available. - Present the source, version, destination, and expected effects to the user. - Require explicit user approval before running the verified file. 5. Run installation with ordinary user privileges unless a documented operation strictly requires elevation. 6. Publish immutable release artifacts and maintain auditable release provenance, such as signed releases or supply-chain attestations. 7. Keep the existing behavior of attempting the connector action before offering setup, but provide safe manual installation instructions after a command-not-found error. 8. Document what files, environment settings, and network endpoints the installer modifies so users can assess its privilege requirements and effects.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs the agent to install software by piping a remotely fetched script directly into bash. This is dangerous because it executes unverified code from the network without integrity checking, so a compromised server, CDN, DNS path, or MITM could lead to arbitrary code execution on the host.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill description says to use this skill for ANY Push by Techulus request and instead of calling the API directly, which is an overly broad routing rule. That can cause the agent to invoke this skill in more situations than necessary, increasing exposure to the skill's shell-based behavior and setup instructions, including potentially risky fallback actions.

Static analysis

No suspicious patterns detected.