screenshot.fyi

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:08 AM UTC
• Version: 1.0.3

Overview

The screenshot.fyi integration is coherent, but its fallback setup tells users to run a remote installer script directly in a shell.

Review the oo CLI installation path before installing. Prefer official package-manager or verified installer steps where possible, inspect downloaded scripts before running them, and do not run the pipe-to-shell commands automatically or from an elevated shell. After setup, the connector workflow itself is narrowly scoped to screenshot.fyi actions through OOMOL.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:52

Finding

Unverified Remote Installation Scripts Executed Directly by Shells

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52–61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

markdown

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
  irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell
  ```

Technical Analysis

The installation instructions retrieve mutable content from external URLs and pass it directly to bash or PowerShell's Invoke-Expression. The downloaded scripts are neither pinned to an immutable version nor verified using a cryptographic digest or publisher signature. Users and agents therefore execute code whose effective contents can change after the Skill has been reviewed.

HTTPS protects the connection in transit but does not establish the integrity of future script versions. Compromise of the hosting service, publisher account, DNS resolution, release process, or remote scripts would allow arbitrary commands to be delivered through these documented installation steps.

Installing the required CLI is related to the Skill's operation, and the instructions limit installation to cases where oo is unavailable. Nevertheless, immediate execution of unreviewed network responses is not the least-privileged or least-risk method of satisfying that requirement. The same weakness exists on both supported shell families.

Attack Path

1. An attacker compromises the remote installation endpoint, its deployment pipeline, the publisher account, or another component capable of changing the returned script.
2. A user invokes this Skill on a system where the oo command is unavailable.
3. Following the documented recovery procedure, the user or agent runs the applicable curl | bash or irm | iex command.
4. The shell execute ...[truncated 933 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both direct pipe-to-shell installation commands.
2. Prefer a trusted platform package manager and pin the CLI to a reviewed version.
3. If standalone installation is necessary, download a versioned artifact to disk without executing it.
4. Publish and verify a pinned SHA-256 digest and, preferably, a signature rooted in a separately distributed trusted publisher key.
5. Abort installation if integrity or signature verification fails.
6. Allow the downloaded installer to be inspected before execution and require explicit user approval before running it.
7. Execute with ordinary user privileges unless a documented operation strictly requires elevation; never request blanket administrator or root access.
8. Apply equivalent controls to the PowerShell path, avoiding Invoke-Expression for network responses.
9. Document the exact files, permissions, and system changes made by the installer so users can evaluate and reverse them.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill instructs the agent/user to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This bypasses integrity verification, review, and provenance checks, so if the hosting site, transport, or distribution path is compromised, arbitrary code will execute on the local system with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Static analysis

No suspicious patterns detected.