Qlty

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:40 AM UTC
• Version: 1.0.3

Overview

The skill mostly matches its Qlty-read purpose, but its first-time setup tells agents to execute remote installer scripts directly without verification or clear user approval.

Install only if you are comfortable trusting OOMOL's installer endpoint, and prefer reviewing or using official, signed, versioned installation instructions before running the setup commands. Avoid letting an agent run the remote installer automatically.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote Installer Executed Directly by Bash## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a mutable shell script from `https://cli.oomol.com/install.sh` and sends it directly to Bash. The retrieved content is executed without being saved for inspection and without version pinning, checksum validation, cryptographic signature verification, or sandboxing. HTTPS protects the script while in transit but does not establish that the content itself is safe. Compromise of the website, DNS infrastructure, hosting account, CDN, signing environment, or installer publication process could cause arbitrary attacker-controlled shell commands to be returned and executed. The effective payload can also change after the Skill has been reviewed. Installing the `oo` CLI supports the Skill's declared functionality, but executing mutable remote content without integrity verification exceeds the minimum privileges and trust required for installation. ### Attack Path 1. A user or agent attempts to use the Skill on a system where the `oo` CLI is unavailable. 2. The resulting `oo: command not found` condition directs it to the first-time setup instructions. 3. It executes the documented `curl` command. 4. `curl` retrieves whatever content `cli.oomol.com` serves at that moment. 5. The pipe forwards the response directly to Bash without review or integrity verification. 6. A compromised or malicious response executes with the privileges of the user running the command. 7. The payload can read accessible files, modify the user environment, install additional software, or retrieve further payloads. ### Impact Assessment Successful exploitation provides arbitrary command execution with the invoking user's privileges. In a typical user context, this may expose source code, environm ...[truncated 557 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `curl | bash` installation instruction. - Prefer a trusted package manager that validates signed, versioned packages. - Otherwise, download a specific immutable release artifact to disk rather than executing a mutable endpoint. - Pin the expected CLI version and verify a publisher-provided cryptographic signature or pinned SHA-256 checksum before execution. - Present the downloaded script for inspection before running it. - Require explicit user approval before installing software. - Run installation with standard user privileges unless a documented operation strictly requires elevation. - Publish installation artifacts and integrity metadata through an independently protected release channel.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66
• Finding: Unverified Remote Installer Executed Directly by PowerShell## Vulnerability Details **File Location**: `SKILL.md`, line 66 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows installation instruction uses `Invoke-RestMethod` (`irm`) to retrieve a mutable PowerShell script and pipes the response directly to `Invoke-Expression` (`iex`). `Invoke-Expression` evaluates the downloaded text as PowerShell code immediately. There is no fixed release version, checksum, signature verification, local inspection step, or constrained execution environment. Consequently, control over the remote response is equivalent to control over PowerShell commands executed on the user's machine. TLS does not mitigate a compromised publisher, hosting account, domain, CDN, or installer deployment process, and the remote payload may change after audit approval. Installing the required CLI is related to the Skill's functionality, but immediate execution of unverified remote code is not the minimum safe installation mechanism. ### Attack Path 1. A Windows user or agent attempts to use the Skill without the `oo` CLI installed. 2. The Skill's first-time setup instructions direct it to the PowerShell command. 3. `Invoke-RestMethod` downloads the current response from `cli.oomol.com`. 4. The pipeline sends the response directly to `Invoke-Expression`. 5. PowerShell executes the response without integrity verification or user inspection. 6. If the endpoint or its delivery infrastructure is compromised, attacker-controlled commands run under the current PowerShell security context. 7. The payload can access user data and credentials, alter PowerShell profiles or other files, and download or launch additional components. ### Impact Assessment Successful exploitation enables arbitrary PowerShell execution with the invoking user's privileges. In a normal user context, this can expose user- ...[truncated 559 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` installation pattern. - Prefer a signed Windows package distributed through a trusted package manager. - If direct download is necessary, use a version-pinned artifact and save it locally before execution. - Validate an Authenticode signature or a pinned cryptographic checksum from an independently secured channel. - Allow the user to inspect the script before running it. - Require explicit approval before installing software or executing an installer. - Do not instruct users to launch an elevated PowerShell session unless a narrowly documented installation step requires it. - Provide rollback and uninstall instructions for the installed CLI.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (`curl ... | bash`). This is dangerous because it executes unaudited code from the network with the user's privileges, and any compromise of the host, transport, or published script could lead to arbitrary code execution. In this skill context, the risk is elevated because the installation step is embedded as an operational fallback, making it more likely an agent or user will run it during troubleshooting.

Static analysis

No suspicious patterns detected.