Rebrandly

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:40 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent for managing Rebrandly through OOMOL, but its first-time setup tells users to execute remote installer scripts directly without verification.

Review the setup instructions before installing. Prefer installing the oo CLI from a verified official package or downloaded installer with integrity checks, and require explicit approval before any write or delete Rebrandly action.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61
• Finding: Unverified Remote Installation Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 61–65 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions retrieve mutable scripts from `cli.oomol.com` and immediately execute their contents with Bash or PowerShell. Neither command pins a release version, verifies a cryptographic signature or checksum, nor saves the script for inspection before execution. Consequently, the code ultimately executed is not limited to the content reviewed in this Skill. Compromise of the hosting service, DNS or delivery infrastructure, or the remote installation pipeline could cause arbitrary attacker-controlled commands to run. The PowerShell and Unix instructions expose the same underlying vulnerability. Installing the CLI is not necessary for ordinary Skill operation when `oo` is already installed. Although the instructions limit installation to a command-not-found failure, automatic remote code execution still exceeds the minimum privileges needed to invoke the declared Rebrandly connector. The Skill otherwise restricts its declared tool access to `Bash(oo *)`, but these installation instructions request execution through general-purpose shells. ### Attack Path 1. An attacker compromises the remote installation script, its hosting infrastructure, or a component capable of altering the delivered response. 2. The `oo` CLI is absent, causing the documented first-time setup path to be used. 3. A user or agent runs the provided `curl | bash` or `irm | iex` command. 4. The shell executes the remotely supplied response without integrity validation or review. 5. The payload performs arbitrary actions with the permissions of the invoking account, potentially installing ...[truncated 801 chars]
• Remediation: ## Remediation Suggestions - Remove direct `curl | bash` and `irm | iex` installation instructions. - Prefer a trusted platform package manager or an official, version-pinned release artifact. - Publish and verify a cryptographic signature or trusted checksum before executing any downloaded installer. - Download the installer to a local file first, verify its origin and integrity, and permit review before execution. - Require explicit user approval before installing software; do not let an agent initiate installation merely because a command failed. - Run installation with the least-privileged account possible and avoid administrator or root execution unless a documented component strictly requires it. - Pin the installer and CLI version so the reviewed behavior cannot change silently after publication. - Keep normal Skill execution confined to the declared `oo` command interface rather than invoking unrestricted shells.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software via `curl ... | bash`, which executes a remote script directly from the network without prior verification, pinning, or integrity checking. If the distribution endpoint, TLS trust chain, or hosting account is compromised, an attacker could achieve arbitrary code execution on the host running the command.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: This markdown file is in scope for vague-trigger review. The description uses extremely broad activation language ("ANY Rebrandly request" and "Whenever a task involves Rebrandly") without narrowing conditions or exclusions, which overlaps with many ordinary mentions of the service and does not specify when the skill should not activate.

Static analysis

No suspicious patterns detected.