Railway

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:04 AM UTC
• Version: 1.0.2

Overview

The skill is coherent for managing Railway through OOMOL, but its setup instructions include unverified remote script execution that should be reviewed before installation.

Before installing, prefer a safer oo CLI installation path with a pinned version and verified checksum or signature. If you use this skill, confirm every deployment, rollback, or variable change carefully because it can modify live Railway resources through your connected OOMOL account.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63
• Finding: Unverified Remote Shell Script Download and Execution## Vulnerability Details **File Location**: `SKILL.md:63` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes a remotely downloaded, mutable shell script directly into `bash`. The downloaded content is not pinned to a version and is not authenticated through a cryptographic signature or verified against a trusted checksum before execution. Although HTTPS provides transport protection, it does not mitigate compromise of the hosting service, publishing account, CDN, DNS infrastructure, or upstream build process. It also cannot prevent the remote script from changing after this Skill has been audited. Consequently, the effective code executed by this instruction is outside the reviewed project. Installing the CLI may support the Skill's declared Railway connector functionality, but immediate execution of an unverified remote script is not the minimum privilege or minimum-risk mechanism necessary to perform that installation. ### Attack Path 1. The `oo` CLI is absent, and execution fails with `oo: command not found`. 2. The user or agent follows the first-time setup instruction in `SKILL.md`. 3. `curl` downloads the current content of `https://cli.oomol.com/install.sh`. 4. The downloaded bytes are passed directly to `bash` without being saved, inspected, version-pinned, or cryptographically verified. 5. If the remote origin or delivery chain has been compromised—or the installer has been maliciously changed—the supplied commands execute immediately. 6. The payload operates with all privileges available to the user running the command. ### Impact Assessment A malicious installer could execute arbitrary commands with the invoking user's privileges. Depending on those privileges and the host environment, it could read or modify use ...[truncated 386 chars]
• Remediation: ## Remediation Suggestions - Do not pipe network responses directly into a shell. - Distribute the CLI through a trusted, authenticated package manager or a pinned official release. - Pin an explicit version rather than retrieving a mutable installer endpoint. - Download the artifact to a local file without executing it. - Verify a published SHA-256 checksum and, preferably, a cryptographic signature whose trusted public key is distributed independently. - Allow the user to inspect the downloaded installer or package before execution. - Require explicit user approval before installation and run it with the least-privileged account possible. - Document the files, permissions, and network endpoints used by the installer.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:67
• Finding: Unverified Remote PowerShell Script Download and Execution## Vulnerability Details **File Location**: `SKILL.md:67` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows installation instruction retrieves a mutable PowerShell script with `Invoke-RestMethod` (`irm`) and immediately executes the response through `Invoke-Expression` (`iex`). No release version, checksum, digital signature, or local review is required. This construction turns the remote endpoint into an arbitrary code-execution channel whose effective payload can change after review. HTTPS alone does not protect against compromise of the source host, publishing credentials, delivery infrastructure, or upstream release process. Use of `iex` also removes the separation between downloaded data and executable instructions. Installing the CLI can be relevant to the declared functionality, but executing an unverified network response is unnecessary and exceeds the minimum-risk mechanism required for setup. ### Attack Path 1. The `oo` CLI is missing on a Windows host. 2. The user or agent follows the documented first-time setup command. 3. `irm` retrieves the current response from `https://cli.oomol.com/install.ps1`. 4. The response is piped to `iex` without version pinning, signature validation, checksum verification, or inspection. 5. A compromised or malicious response is interpreted immediately as PowerShell code. 6. The payload receives the same user rights and accessible resources as the PowerShell process. ### Impact Assessment Successful exploitation provides arbitrary PowerShell execution under the invoking user's security context. The payload could access user-readable files, collect credentials, modify profiles or local tools, establish persistence, or retrieve additional malware. Execution from an elevated PowerShell session co ...[truncated 152 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm ... | iex` installation pattern. - Publish a versioned, Authenticode-signed installer or package through a trusted package repository. - Download the installer separately and validate both its digital signature and a checksum obtained through an independently authenticated channel. - Pin the expected CLI version and avoid mutable installer URLs. - Present the downloaded file for inspection before execution. - Require explicit user authorization before installing software. - Run installation without administrative privileges unless a narrowly documented operation specifically requires elevation. - Document expected filesystem modifications, requested permissions, and network communication.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 96% confidence
• Finding: The skill instructs users to install software by piping a remotely fetched script directly into bash. If the install endpoint, network path, or hosting account is compromised, arbitrary code would execute immediately on the local system without verification.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The skill description says to use this skill for ANY Railway request and instead of calling the API directly, which creates an overly broad routing trigger. This can cause the agent to invoke a powerful integration for unrelated or insufficiently scoped requests, increasing the chance of unintended read/write/destructive operations in a live Railway account.

Static analysis

No suspicious patterns detected.