ScraperAPI

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:30 AM UTC
• Version: 1.0.2

Overview

The skill is coherent for ScraperAPI use, but its fallback setup tells the agent or user to execute remote installer scripts without verification.

Review this skill before installing if you do not already trust OOMOL's installer path. Prefer installing the oo CLI through a version-pinned or verified method, inspect installer contents before running them, and require explicit approval before any ScraperAPI write action such as submit_url.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:57
• Finding: Unverified Remote Installer Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 57–61 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download installer scripts over the network and pass their contents directly to a command interpreter. Neither command pins an immutable release nor verifies a cryptographic checksum or signature before execution. Installation of the `oo` CLI supports the Skill's declared ScraperAPI functionality, and the instructions only recommend installation after a command-not-found error. However, immediate execution of mutable remote content is not the minimum safe mechanism required to install the dependency. The effective code can change after the Skill has been audited. No evidence establishes that the currently hosted installers are malicious. Nevertheless, compromise of the hosting infrastructure, publishing account, DNS resolution, or another part of the delivery chain could turn these documented commands into an arbitrary-code-execution mechanism. ### Attack Path 1. The `oo` CLI is unavailable, causing the user or Agent to follow the first-time setup instructions. 2. An attacker compromises or gains control over the remote installer delivery path. 3. The attacker replaces the expected installer response with a malicious shell or PowerShell payload. 4. `curl | bash` or `irm | iex` executes the response immediately without integrity or authenticity verification. 5. The payload runs with the privileges of the user who invoked the installation command. ### Impact Assessment Successful exploitation permits arbitrary command execution within the invoking user's security context. The resulting scope may include access to ...[truncated 531 chars]
• Remediation: ## Remediation Suggestions 1. Replace pipe-to-shell installation with a trusted package manager or a version-pinned official release. 2. If a standalone artifact is required, download it to disk without executing it immediately. 3. Pin the artifact to a specific version and immutable release URL. 4. Publish a SHA-256 checksum and preferably a cryptographic signature through an independently protected channel. 5. Verify the checksum and signature before execution, and abort installation on any mismatch. 6. Allow the user to inspect the downloaded installer before explicitly approving execution. 7. Run installation with ordinary user privileges unless a specific operation demonstrably requires elevation. 8. Document the files, permissions, and configuration changes performed by the installer.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 95% confidence
• Finding: The skill includes a one-line installation command that downloads a remote script and pipes it directly to bash. This bypasses integrity verification and gives the remote host immediate code execution on the user's machine, so a compromised server, MITM, or malicious script update could lead to arbitrary command execution.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill description instructs the agent to use this skill for ANY ScraperAPI request, which is an overly broad routing rule. This can cause the skill to be invoked in situations the user did not intend, increasing the chance of unnecessary external requests or accidental execution of write-capable actions in a third-party service context.

Static analysis

No suspicious patterns detected.