Sage HR

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:25 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a coherent Sage HR read-only connector, but its setup instructions tell users to execute unverified remote installer scripts.

Review the setup path before installing. Use this skill only if you are comfortable with OOMOL's oo CLI and Sage HR connection model, and prefer a verified or manually reviewed installer rather than running the documented curl|bash or irm|iex commands directly. Expect the skill to access sensitive HR records through your connected OOMOL/Sage HR account.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Remote Shell Script Downloaded and Executed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:62` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Code Snippet**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The first-time setup instructions pipe a remotely retrieved installation script directly into Bash. The script is neither version-pinned nor cryptographically verified before execution. Its effective behavior can therefore change after the Skill has been reviewed. Although the URL uses HTTPS and appears associated with the declared OOMOL service, HTTPS alone does not protect against compromise of the publishing account, origin server, CDN, DNS infrastructure, or signing pipeline. The use of `curl -fsSL` also suppresses normal progress and some diagnostic output, while piping prevents meaningful review before execution. Installing the CLI may be necessary for the declared Sage HR integration, but immediate execution of mutable remote content is not the minimum privilege or safest installation method required to achieve that purpose. ### Attack Path 1. The `oo` CLI is absent and an invocation fails with `oo: command not found`. 2. The Agent or user follows the documented first-time setup instruction. 3. An attacker compromises the remote script, its publishing account, delivery infrastructure, or another trusted component in the delivery path. 4. `curl` retrieves the attacker-controlled response. 5. The shell pipe sends the response directly to Bash without signature verification, hash validation, version pinning, or prior inspection. 6. Bash executes the payload with the privileges of the invoking account. ### Impact Assessment Successful exploitation provides arbitrary command execution with the invoking user's privileges. The payload could read or modify accessible files, steal session credentials or application data, install additional softwa ...[truncated 169 chars]
• Remediation: ## Remediation Suggestions - Do not pipe downloaded content directly into a shell. - Direct users to a version-pinned release from a verified official repository or package manager. - Download the installer as a separate file and verify a vendor-published cryptographic signature or SHA-256 digest before execution. - Display or inspect the verified installer before running it. - Require explicit user approval before installing software. - Run installation with the least-privileged account possible and avoid elevation unless a documented step strictly requires it. - Pin the installer URL and expected digest to an audited release, with a controlled process for updates.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66
• Finding: Remote PowerShell Script Downloaded and Evaluated Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:66` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Code Snippet**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows setup command retrieves mutable PowerShell content with `Invoke-RestMethod` (`irm`) and immediately evaluates it with `Invoke-Expression` (`iex`). There is no release pinning, Authenticode validation, digest verification, or opportunity to inspect the content before execution. The remote host appears related to the declared OOMOL service, but that association does not eliminate supply-chain or hosting-compromise risks. Because `iex` interprets the response in memory, any PowerShell commands supplied by the endpoint execute in the current security context. Installing the connector CLI may support the Skill's intended functionality, but direct evaluation of unverified network content exceeds the minimum behavior necessary for installation. ### Attack Path 1. The `oo` CLI is unavailable on a Windows system. 2. The Agent or user follows the documented PowerShell setup instruction. 3. An attacker alters the installer by compromising the origin, publishing credentials, delivery infrastructure, or another trusted supply-chain component. 4. `irm` retrieves the modified script. 5. The pipeline passes the response to `iex` without integrity or publisher verification. 6. PowerShell executes the attacker-controlled commands with the invoking user's privileges. ### Impact Assessment Successful exploitation allows arbitrary PowerShell execution in the user's security context. This may expose accessible HR information, local files, browser or application credentials, and authenticated sessions. The payload could also alter system configuration, download additional malware, or create persistence. Execution from an elevated PowerShell ses ...[truncated 44 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` installation pattern. - Provide a version-pinned, vendor-signed installer or package from an authenticated official release channel. - Save the installer locally before execution. - Validate its Authenticode signature and a separately published cryptographic digest. - Require explicit user approval after verification and before execution. - Use the least-privileged Windows account and avoid administrative execution unless strictly required. - Document the expected signer, exact release version, digest, and safe failure behavior when verification does not succeed.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs the agent to install software by piping a remote script directly into a shell (`curl ... | bash`), which is a classic supply-chain and remote code execution risk. If the install endpoint, transport, or upstream distribution is compromised, the agent could execute arbitrary attacker-controlled code on the host.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use this skill for "ANY Sage HR request" and "Whenever a task involves Sage HR," which is an intentionally broad trigger with no negative examples or scope boundaries. In a manifest/markdown context, this can cause unintended invocation for casual mentions or loosely related tasks involving Sage HR.

Static analysis

No suspicious patterns detected.