Security audit

SamCart

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent SamCart reader, but its setup asks users to execute a remote installer script and its wording leaves some authority boundaries ambiguous.

Review the installer source and prefer a verified installation method before using this skill. Install only if you are comfortable connecting OOMOL to SamCart business/customer data, and treat the skill as read-only unless the live connector schema clearly exposes additional actions and you explicitly approve them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest says the skill is for 'searching and reading data,' but the body also describes support for state-changing '[write]' and '[destructive]' actions. This mismatch can mislead an orchestrator or reviewer into granting the skill broader authority than expected, increasing the risk of unintended modification if write actions are later exposed through the connector.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The skill instructs users to install software via 'curl ... | bash', which executes a remotely fetched script without prior verification. If the remote host, transport, or distribution pipeline is compromised, this can lead to arbitrary code execution on the user's machine.
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

bash
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux

powershell

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The phrase 'Use this skill for ANY SamCart request' is overly broad and may cause the skill to be invoked for loosely related tasks without sufficient scoping. Broad routing language can bypass least-privilege decision-making and funnel operations into a connector-backed path even when the task does not require it.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation asserts that actions tagged '[write]' or '[destructive]' exist and gives execution guidance for them, but the enumerated action list contains only read operations. This inconsistency creates ambiguity about the real capability surface, which can cause unsafe assumptions during review or future expansion without proper guardrails.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.