Security audit

Sanity

Security checks for vulnerabilities and agentic risk

Overview

The skill is useful for Sanity access, but it mixes read-only framing with write-capable Sanity mutations and risky remote installer commands.

Review this before installing. Use it only if you are comfortable with an OOMOL-connected Sanity account being available to the agent, and avoid mutation actions unless you explicitly request and approve the exact payload. Prefer installing the oo CLI through a verified release or package manager rather than running the pipe-to-shell commands shown in the skill.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:57
Finding: Unverified Remote Installer Execution Through Pipe-to-Shell Commands<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:57-61` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable scripts from external URLs and immediately execute their contents using Bash or PowerShell. No version is pinned, and the instructions do not require a cryptographic signature, fixed checksum, or manual inspection before execution. The effective code executed on the user's machine is therefore not contained in the audited Skill. It can change after review without any corresponding modification to `SKILL.md`. Although the download domain is consistent with the named OOMOL service, compromise of the domain, hosting infrastructure, release pipeline, DNS resolution, or installer content could turn these commands into arbitrary code-execution vectors. This behavior exceeds the minimum privileges required for normal Sanity search and retrieval operations. The Skill states that users should generally have the CLI installed already, so automatic execution of a remote installer is not necessary for routine use. ### Attack Path 1. An attacker compromises the installer endpoint, its hosting or deployment pipeline, or another component capable of changing the returned script. 2. The `oo` command is unavailable, causing the user or agent to follow the first-time setup instructions. 3. `curl` or `irm` downloads the attacker-controlled response. 4. The shell pipeline passes the response directly to Bash or `Invoke-Expression`. 5. The payload executes without integrity verification or an opportunity for inspection. 6. The payload can access resources available to the invoking user and may download additional code, steal credentials, modify f ...[truncated 466 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | bash` and `irm | iex` installation patterns. 2. Direct users to an official package manager or a pinned release artifact from a documented release page. 3. Download the installer or binary to disk without executing it automatically. 4. Pin an exact CLI version rather than relying on a mutable installer URL. 5. Publish and verify a cryptographic signature and a fixed SHA-256 or stronger checksum before installation. 6. Allow the user to inspect the downloaded artifact before execution. 7. Require explicit user approval before installing software or executing any downloaded code. 8. Run installation with ordinary user privileges unless elevated privileges are demonstrably required. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:36
Finding: Undeclared Sanity Mutation Capability Bypasses the Documented Confirmation Policy<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:3-4, 36-44` **Vulnerability Type**: Excessive capability and ineffective write-operation authorization control **Risk Level**: High ### Vulnerable Code ```yaml description: "Sanity (sanity.io). Use this skill for ANY Sanity request — searching and reading data. Whenever a task involves Sanity, use this skill instead of calling the API directly." allowed-tools: [Bash(oo *)] ``` ```markdown ## Available actions - `get_documents` — Retrieve the latest Sanity documents by ID while bypassing the query cache. - `mutate_documents` — Execute an atomic transaction of Sanity document mutations. - `query_documents` — Run a GROQ query against a Sanity Content Lake dataset. ## Safety - Untagged actions are reads (get / list / search) — safe to run directly. - **Actions tagged `[write]` change Sanity state — confirm the exact payload and effect with the user before running.** - **Actions tagged `[destructive]` remove or overwrite data — always confirm the target and get explicit approval first.** ``` ### Technical Analysis The Skill declares its purpose as searching and reading Sanity data, but it also exposes `mutate_documents`, which can change Sanity documents. This write capability exceeds the stated read-oriented functionality. The documented safety mechanism only requires confirmation for actions explicitly carrying a `[write]` or `[destructive]` tag. However, `mutate_documents` has no such tag. The same document states that untagged actions are safe reads, creating an internally inconsistent policy under which a state-changing operation may be treated as read-only and executed without confirmation. In addition, `allowed-tools: [Bash(oo *)]` permits all `oo` CLI subcommands rather than restricting execution to the connector schema and read-only Sanity operations needed by the declared functionality. This broad permission weakens least-privilege boundaries. ### Attack Path 1. A task, malformed ...[truncated 1262 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `mutate_documents` if the Skill is intended solely for searching and reading. 2. Restrict tool permissions to the minimum required `oo connector schema` and read-only Sanity connector operations instead of allowing `Bash(oo *)`. 3. If mutation support is intentional, update the declared functionality to disclose write access accurately. 4. Mark `mutate_documents` with `[write]`, and mark it `[destructive]` as well whenever its supported payload can remove or overwrite data. 5. Require explicit user approval for the exact target, payload, and expected effect before every mutation. 6. Validate the live action schema and present a human-readable mutation summary before requesting approval. 7. Enforce write authorization technically where possible rather than relying only on prose instructions. 8. Use a read-only Sanity credential or connector scope for read-focused deployments. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The manifest and description frame the skill as only for searching and reading data, but the documented actions include `mutate_documents`, which can change state. This capability mismatch can mislead an agent or user into invoking a write-capable skill under the assumption it is read-only, increasing the risk of unintended data modification.

External Script Fetching

High

Category: Supply Chain
Content: - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell
Confidence: 95% confidence
Finding: The skill instructs the operator to execute a remote installer via `curl ... | bash`, which runs network-fetched code without verification. If the install endpoint, transport, or upstream distribution is compromised, this can lead to arbitrary code execution on the host running the command.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The instruction to use this skill for ANY Sanity request is overly broad and can cause agents to route all Sanity-related tasks through a tool that includes write functionality. In context, this broad trigger combines with the hidden mutating capability to widen the chance of misuse or accidental invocation beyond narrowly scoped read operations.

Static analysis

No suspicious patterns detected.