Quriiri

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:12 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent for managing Quriiri SMS through OOMOL, but its first-time setup tells users to execute remote installer scripts directly in a shell.

Review the installer commands before using this skill. Prefer installing the oo CLI through a verified package or documented manual process, avoid running remote scripts directly in a shell, and confirm every SMS send payload before allowing the write action.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58
• Finding: Unverified Remote Installer Scripts Executed Directly by Shells<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 58–62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable scripts from an external URL and immediately execute them using Bash or PowerShell. Neither installation path pins a specific release or expected cryptographic digest, verifies a publisher signature, saves the script for inspection, nor constrains the privileges available to the installer. HTTPS protects the connection in transit but does not make the retrieved payload immutable. The effective code can change after the Skill has been audited. Compromise of the download service, publishing account, DNS infrastructure, TLS trust path, or upstream build process could therefore turn these instructions into an arbitrary-code execution channel. Installing the declared CLI may be necessary when it is absent, and the Skill appropriately presents installation as an error-triggered fallback rather than a routine action. However, immediate execution of unverified network content exceeds the minimum privilege and trust necessary to install that CLI. No evidence establishes that the currently hosted scripts are malicious; the vulnerability is the unsafe and mutable execution mechanism. ### Attack Path 1. The `oo` CLI is genuinely absent, or the user encounters an error interpreted as `oo: command not found`. 2. The Agent or user follows the first-time setup instructions. 3. An attacker compromises or controls the remote installer response through the hosting or publication infrastructure, DNS, TLS trust path, or another upstream supply-chain component. 4. `curl` or `Invoke-RestMethod` retrieves the attacker-controlled script. 5. The pipe to ...[truncated 921 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove both direct download-to-shell patterns. 2. Prefer a trusted operating-system package manager or an official package repository that performs package-signature and integrity verification. 3. Pin the installation to a specific audited CLI release rather than a mutable installer endpoint. 4. If direct download is unavoidable: - Download the artifact without executing it. - Obtain the expected SHA-256 digest or signature through a separately trusted channel. - Verify the digest and publisher signature locally. - Stop installation if verification fails. - Present the verified script or package for review before execution. 5. Require explicit, informed user approval before installing software or running installer code. 6. Run installation without administrative privileges unless a specific installation step demonstrably requires elevation. 7. Document the expected files, directories, network destinations, and configuration changes made by installation. 8. Keep the existing behavior of attempting installation only after a genuine command-not-found error. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs the agent to install software by piping a remotely fetched script directly into a shell, which is a classic supply-chain and remote-code-execution risk. If the install endpoint, CDN, TLS trust chain, or upstream publisher is compromised, arbitrary code would execute immediately on the host without review.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: This invocation guidance is broad enough that any mention of Quriiri could trigger the skill, without specifying scope limits or exclusion cases. The file does not provide negative examples or narrower trigger constraints to reduce unintended activation.

Static analysis

No suspicious patterns detected.