Raisely

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:30 AM UTC
• Version: 1.0.2

Overview

The Raisely skill is mostly coherent, but its first-time setup recommends running unverified internet installer scripts.

Review the installer path before installing. Prefer installing the oo CLI through a verified, version-pinned, checksum- or signature-checked method, and only allow write or delete Raisely actions after confirming the exact payload and target.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote Bash Script Download and Execution## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Critical **Complete Code Snippet**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The first-time setup instructions pipe a remotely hosted installation script directly into Bash. The downloaded content is mutable and is neither pinned to a reviewed version nor verified using a cryptographic signature or trusted checksum before execution. This creates a remote code execution and supply-chain risk. Control or compromise of the hosting service, installation script, publishing credentials, or another trusted delivery component would permit the served payload to be changed after this Skill was audited. Bash would execute that changed payload immediately with the privileges of the user running the Agent. Installing the required CLI may support the declared Raisely connector functionality, but immediate network-to-shell execution exceeds the minimum mechanism necessary. A version-pinned, integrity-verified installation method can provide the same functionality without blindly executing the current server response. ### Attack Path 1. The `oo` CLI is absent, causing an `oo: command not found` failure. 2. The Agent follows the documented first-time setup procedure. 3. An attacker compromises the remote installation script or a trusted component of its publication and delivery chain. 4. `curl` retrieves the attacker-modified response from the external URL. 5. The shell pipeline passes the response directly to Bash without review or integrity verification. 6. Bash executes the attacker's commands with the invoking user's privileges. ### Impact Assessment A successful exploit could execute arbitrary commands as the invoking user. Depending on that user's privileges and accessible resources, an attacker could read or alte ...[truncated 476 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `curl | bash` pipeline. - Prefer an official operating-system package manager with package-signing verification. - Alternatively, download a version-pinned release artifact to disk, verify its publisher signature and a hardcoded cryptographic checksum, and only then execute it. - Ensure checksums and signatures are obtained through an independently trusted or authenticated channel. - Display the artifact source and version and require explicit user approval before installation. - Run installation with ordinary user privileges unless elevated privileges are strictly required and separately approved. - Document how users can inspect the installer and verify its provenance before execution.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66
• Finding: Unverified Remote PowerShell Script Download and Execution## Vulnerability Details **File Location**: `SKILL.md`, line 66 **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Critical **Complete Code Snippet**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows setup procedure retrieves a mutable PowerShell script from an external URL using `Invoke-RestMethod` (`irm`) and immediately evaluates the response using `Invoke-Expression` (`iex`). There is no version pinning, Authenticode validation, cryptographic checksum verification, or local review between retrieval and execution. Consequently, compromise of the remote script, its publishing credentials, or another trusted delivery component can convert this documented setup command into arbitrary PowerShell execution. The effective payload may change after the Skill package has been reviewed. Installation of the CLI may be legitimate, but evaluating an unverified network response is not necessary to accomplish that task and violates least-risk installation practices. ### Attack Path 1. The `oo` CLI is unavailable on a Windows system. 2. The Agent or user follows the documented PowerShell setup command. 3. An attacker modifies the externally hosted installer through compromise of the hosting or publication chain. 4. `irm` downloads the attacker-controlled script content. 5. The pipeline passes the response directly to `iex`. 6. PowerShell evaluates the malicious content with the current process user's privileges. ### Impact Assessment Exploitation permits arbitrary PowerShell commands under the invoking user's security context. An attacker could access or modify user files, extract available credentials or tokens, alter local tooling, download further payloads, or configure persistence. The scope depends on the permissions and resources available to the invoking user. Administrator privileges are not inherently gra ...[truncated 116 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` installation pattern. - Distribute a version-pinned installer or package through a trusted package manager. - Download the installer to disk before execution and validate its Authenticode signature and a published cryptographic checksum. - Reject unsigned artifacts, signature mismatches, unexpected publishers, and checksum mismatches. - Require explicit user approval after presenting the source, publisher, version, and requested privilege level. - Avoid elevated PowerShell unless installation genuinely requires it and the user separately authorizes elevation. - Provide manual inspection and offline-verification instructions as a safer fallback.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs the agent to install software by piping a remote script directly into bash, which is a classic supply-chain risk. If the install endpoint, transport, publisher account, or hosting is compromised, arbitrary code could execute immediately on the user's machine without review.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The description says to use this skill for "ANY Raisely request," including reading, creating, updating, and deleting data. This is an extremely broad invocation condition with no limiting context or negative examples, which could cause unintended activation for ordinary Raisely-related mentions.

Static analysis

No suspicious patterns detected.