Readwise

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:13 AM UTC
• Version: 1.0.2

Overview

The skill is coherent for Readwise access, but its first-time setup tells users to execute remote installer scripts directly, which deserves manual review before installation.

Install only after reviewing a safer, verified oo CLI installation path. Avoid running the pipe-to-shell commands blindly, run setup from a normal user account, and confirm exact payloads before allowing write actions to modify Readwise data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60
• Finding: Unverified Remote Shell Script Execution on macOS and Linux## Vulnerability Details **File Location**: `SKILL.md`, line 60 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a mutable script from an external server and pipes it directly into `bash`. The payload is executed without being saved for inspection, pinned to an immutable version, or validated through a cryptographic signature or checksum. HTTPS protects the connection in transit but does not protect users if the hosting infrastructure, publishing account, DNS configuration, or installer itself is compromised. Because the effective script can change after the Skill has been audited, its actual behavior cannot be established from the contents of this project. Installing the required CLI may be necessary for first-time setup, but immediate remote shell execution is not the minimum privilege or safest mechanism necessary to install it. The installer runs with the invoking user's general shell privileges, which is broader than the Skill's declared runtime restriction of `Bash(oo *)`. ### Attack Path 1. An attacker compromises the installer endpoint, its deployment pipeline, publishing credentials, or another component capable of changing the response from `https://cli.oomol.com/install.sh`. 2. The `oo` command is unavailable, causing the user or agent to follow the documented first-time setup procedure. 3. `curl` retrieves the attacker-controlled response. 4. The shell pipeline passes the response directly to `bash` without integrity verification or an inspection boundary. 5. The payload executes with the privileges of the account running the command and may retrieve further payloads, alter local files, or establish persistence. ### Impact Assessment Successful exploitation provides arbitrary command execution ...[truncated 473 chars]
• Remediation: ## Remediation Suggestions Replace the pipe-to-shell installation command with a verifiable installation process: 1. Link to a version-pinned release artifact hosted by a verified publisher. 2. Download the artifact to a local file rather than executing the network response directly. 3. Publish and require verification of a cryptographic signature or a SHA-256 checksum obtained through a separately secured channel. 4. Allow the user to inspect the downloaded script or package before execution. 5. Document the exact files, directories, and permissions modified by the installer. 6. Avoid elevated privileges unless a specific platform operation requires them, and explain each such operation. 7. Prefer a trusted platform package manager with package signing and pinned versions where available. 8. Keep installation manual and user-controlled; the Skill should not automatically execute setup commands after a command-not-found error. A safer workflow is to download a pinned installer, verify its signature or checksum, and only then run the verified local file.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64
• Finding: Unverified Remote PowerShell Script Execution on Windows## Vulnerability Details **File Location**: `SKILL.md`, line 64 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical **Vulnerable Code**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The instruction uses `Invoke-RestMethod` (`irm`) to retrieve a mutable PowerShell script and sends the response directly to `Invoke-Expression` (`iex`). This causes remotely supplied text to execute as PowerShell code without local inspection, version pinning, Authenticode validation, or cryptographic checksum verification. The effective payload is controlled by the content served at the external URL and may change independently of the reviewed Skill. TLS does not address compromise of the legitimate hosting environment or release process. Although installation of the CLI supports the declared functionality, executing mutable remote text through `Invoke-Expression` grants a general code-execution channel exceeding the Skill's normal need to invoke only `oo` commands. ### Attack Path 1. An attacker gains the ability to modify the PowerShell installer or the response delivered from `https://cli.oomol.com/install.ps1`. 2. A Windows user encounters a missing `oo` command and follows the first-time setup instructions. 3. `Invoke-RestMethod` downloads the modified script into the PowerShell pipeline. 4. `Invoke-Expression` evaluates the response immediately, with no signature, checksum, or review step. 5. The malicious script executes with the current PowerShell process's privileges and can invoke additional system or network operations. ### Impact Assessment Exploitation yields arbitrary PowerShell execution under the invoking user's security context. A malicious installer could access user-readable files and credentials, modify the user's profile or startup configuration, download additional executables, exfiltrate data, or crea ...[truncated 228 chars]
• Remediation: ## Remediation Suggestions Replace the `irm | iex` pattern with a signed and version-pinned installation workflow: 1. Publish a specific, immutable installer release rather than relying on a mutable generic URL. 2. Download the installer to disk without evaluating it. 3. Validate an Authenticode signature from the expected publisher and fail closed if the signature is absent or invalid. 4. Additionally publish a SHA-256 checksum through a separately protected release channel and verify it before execution. 5. Present the local file and intended changes to the user before running it. 6. Prefer a signed package distributed through a trusted Windows package manager where possible. 7. Do not require an administrator PowerShell session unless clearly necessary, and document any requested privileges. 8. Ensure that setup remains an explicit user-controlled operation rather than an automatic response to an authentication or command failure.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 92% confidence
• Finding: The skill instructs users to install software via `curl ... | bash`, which downloads and immediately executes a remote script without any integrity verification, pinning, or manual inspection. If the hosting endpoint, transport, or upstream distribution process is compromised, this becomes a direct remote code execution path on the user's machine.

Static analysis

No suspicious patterns detected.