Runscope

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:40 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a read-only Runscope helper, but its setup instructions ask users to execute an unverified remote installer.

Review the oo CLI installation path before using this skill. Prefer installing the CLI from a trusted, versioned source with verification rather than piping a remote script directly into Bash or PowerShell, and only connect the Runscope account when you intend to let OOMOL mediate read access to that Runscope data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61
• Finding: Unverified Remote Installer Download and Immediate Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 61–65 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from `cli.oomol.com` and pass their contents directly to a command interpreter. Neither command pins an immutable installer version nor verifies a cryptographic signature or checksum before execution. This design separates the code reviewed in the Skill from the code ultimately executed. The effective payload can change at any time after the audit. Compromise of the distribution server, publishing account, domain, DNS resolution, TLS infrastructure, or upstream build process could consequently turn the documented installation step into arbitrary code execution. Installing the required CLI supports the Skill's stated Runscope functionality, and the instructions only recommend installation after a command-not-found error. However, executing an unverified remote response immediately is not the minimum privilege or safest mechanism necessary to install that CLI. ### Attack Path 1. A user or Agent attempts to use the Skill on a system where the `oo` CLI is not installed. 2. The command fails with `oo: command not found`. 3. The user or Agent follows the first-time setup instructions. 4. `curl` or `Invoke-RestMethod` retrieves a mutable installer from the external OOMOL host. 5. The response is passed directly to Bash or PowerShell without integrity or authenticity verification beyond transport-level TLS. 6. If the hosted installer or delivery infrastructure has been compromised, attacker-controlled commands execute under the identity of the invoking user. ### Impact Assessment A substituted installer could ...[truncated 739 chars]
• Remediation: ## Remediation Suggestions 1. Remove the direct `curl | bash` and `irm | iex` installation patterns. 2. Prefer a trusted platform package manager or a version-pinned release artifact from an official, documented distribution channel. 3. Require the installer or binary to be downloaded as a separate file before execution. 4. Publish a cryptographic checksum or digital signature through an independently protected channel and require verification before running the artifact. 5. Pin the CLI and installer to a specific immutable release rather than a mutable `install.sh` or `install.ps1` endpoint. 6. Display the resolved artifact URL, version, and expected digest so users can audit exactly what will execute. 7. Run installation with ordinary user privileges whenever possible. Request elevation only for a narrowly defined operation that genuinely requires it. 8. Document the installer's expected filesystem changes, network destinations, and required permissions. 9. If a bootstrap script remains necessary, download it first, verify its signature or checksum, allow inspection, and invoke it only after successful verification.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs fetching and executing a remote installer via `curl ... | bash`, which is a classic supply-chain and arbitrary code execution risk. Even though it is framed as first-time setup, embedding this command in a skill makes it more dangerous because an agent may surface or run it in response to a missing dependency, executing unverified code directly from the network.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The description says to use this skill for "ANY Runscope request" and "instead of calling the API directly," which is an overly broad invocation rule. Broad triggers can cause the agent to select this skill in situations beyond simple read-only retrieval, increasing the chance it follows embedded operational instructions or reaches external tooling without sufficient user intent validation.

Static analysis

No suspicious patterns detected.