Sender

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:05 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a coherent Sender connector, but its setup instructions include unverified remote installer commands that could execute mutable code on the user's machine.

Review the install steps before using this skill. Prefer installing the oo CLI through a pinned, verifiable package or official instructions that let you inspect and verify the installer first. Once the CLI is installed and authenticated, Sender read/write behavior is disclosed, but confirm any subscriber, group, or field changes carefully, especially destructive removals.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:68
• Finding: Unverified Remote Installation Scripts Are Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 68–72 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from `cli.oomol.com` and immediately execute them using `bash` or PowerShell's `Invoke-Expression` (`iex`). Neither command pins a release version, verifies a cryptographic signature, validates a checksum, nor gives the user an opportunity to inspect the retrieved payload before execution. HTTPS protects the connection in transit but does not guarantee that the hosted payload remains identical to the version originally reviewed. Compromise of the domain, hosting environment, DNS resolution, CDN, publishing credentials, or upstream release pipeline could cause arbitrary attacker-controlled code to be delivered. Installing a required CLI is related to the Skill's declared functionality, but executing an unverified remote script is not the minimum-privilege or minimum-risk installation method. The PowerShell command presents the same underlying risk as the `curl | bash` pattern. ### Attack Path 1. The `oo` CLI is unavailable, causing an `oo: command not found` error. 2. The agent or user follows the documented first-time setup instructions. 3. The shell retrieves a mutable script from `https://cli.oomol.com/install.sh` or `https://cli.oomol.com/install.ps1`. 4. A compromised hosting or software-delivery system supplies modified script content. 5. The downloaded content is passed directly to `bash` or `iex` without integrity verification or inspection. 6. The malicious content executes immediately with the privileges of the invoking account. ### Impact Assessment Successful exploitation provides arbitrary code executio ...[truncated 652 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace direct pipe-to-shell and `iex` installation with a version-pinned package from an authenticated package manager or a specific, immutable release artifact. 2. Download the installer to disk rather than executing the HTTP response directly. 3. Publish a cryptographic signature and SHA-256 checksum through a separately protected release channel, and verify both before execution. 4. Require explicit user approval after displaying the artifact source, pinned version, checksum, expected installation paths, and requested permissions. 5. Execute the installer without administrative privileges unless a documented operation strictly requires elevation. 6. Prefer commands such as the following conceptual sequence: - Download a specific release. - Verify its signature and pinned checksum. - Inspect or display the installer. - Execute it only after explicit confirmation. 7. Document the files, environment changes, network destinations, and shell-profile modifications expected from installation. 8. Avoid automatic installation by the agent. If the CLI is missing, provide verified manual installation instructions and stop until the user confirms completion. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs the agent to execute a remote install script via 'curl ... | bash', which is a classic supply-chain and arbitrary code execution risk. If the remote server, distribution path, DNS, TLS trust chain, or install script is compromised, the host running the skill could execute attacker-controlled code immediately.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The phrase "Use this skill for ANY Sender request" is extremely broad and could match many ordinary tasks involving Sender without clarifying boundaries or exclusions. The description also says to use this skill "instead of calling the API directly," but provides no negative examples or scope constraints to prevent unintended invocation.

Static analysis

No suspicious patterns detected.