SF Express

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:51 PM UTC
• Version: 1.0.0

Overview

This SF Express skill is coherent, but it can change live shipment and business data while using broad command access and incomplete confirmation boundaries.

Install only if you trust OOMOL and need an agent to operate your SF Express account. Before use, review the oo CLI installer instead of piping it directly to a shell, connect the least-privileged SF Express account available, and require explicit approval for any action that could create, cancel, update, append, report, upload, register, send, charge, or delete data, even when the skill does not tag it as [write].

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:208
• Finding: Unverified Remote Installation Scripts Are Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 208-212 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The setup instructions download mutable scripts from an external server and pass them directly to a command interpreter. Neither command pins a script version, verifies a cryptographic signature or checksum, nor gives the user an opportunity to inspect the downloaded content before execution. HTTPS protects transport in ordinary circumstances, but it does not establish that the hosted script has remained unchanged since the Skill was audited. Compromise of the hosting account, web server, CDN, DNS infrastructure, TLS termination layer, or release pipeline could turn these installation commands into an arbitrary-code delivery mechanism. This behavior is not the minimum privilege necessary to install a CLI. A versioned artifact can be downloaded and authenticated before execution instead. ### Attack Path 1. The `oo` command is unavailable, causing the Agent or user to follow the first-time setup instructions. 2. An attacker compromises or gains control over the installation endpoint or its delivery infrastructure. 3. The attacker replaces the expected installer with a malicious shell or PowerShell payload. 4. The documented command downloads the modified payload. 5. `bash` or `iex` executes the payload immediately, without integrity verification or review. 6. The payload operates with the permissions of the user running the installation command. ### Impact Assessment Successful exploitation provides arbitrary code execution under the invoking user's account. The payload could read or modify accessible files, collect environment variables and credentials, alter de ...[truncated 364 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all pipe-to-shell and download-to-`iex` installation commands. 2. Distribute the CLI as a version-pinned package or release artifact. 3. Download the artifact to disk before execution. 4. Publish SHA-256 or stronger checksums through an independently protected release channel and verify them locally. 5. Prefer signed artifacts and verify the publisher signature and certificate chain. 6. Display or otherwise make the installer available for inspection before it runs. 7. Document the exact files, permissions, and network access required by the installer. 8. Do not request administrative privileges unless a specific installation step requires them. 9. Pin the documentation to a known release rather than a mutable generic `install.sh` or `install.ps1` endpoint. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:6
• Finding: CLI Tool Permission Is Broader Than the Declared SF Express Scope<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 6 **Vulnerability Type**: Excessive tool authorization and failure to enforce least privilege **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: [Bash(oo *)] ``` ### Technical Analysis The Skill declares that it operates the `sf_express` connector, but its tool policy permits every command beginning with `oo`. The documented functionality only requires narrowly defined schema inspection and connector execution operations for one connector: ```bash oo connector schema "sf_express" --action "<action_name>" oo connector run "sf_express" --action "<action_name>" --data '<json>' --json ``` The wildcard authorization does not enforce the documented connector boundary. It may permit unrelated `oo` subcommands or other connectors supported by the CLI. Documentation telling the Agent to use `sf_express` is not equivalent to a technical access-control restriction. ### Attack Path 1. The Skill is loaded with permission to execute any command matching `oo *`. 2. A malformed request, prompt injection, incorrect action selection, or future change to the Skill causes an `oo` command outside the required SF Express command set to be generated. 3. The wildcard tool rule authorizes the command because it begins with `oo`. 4. The CLI executes the unrelated operation using the current user's OOMOL session and available connected services. 5. Data may be accessed or changed outside the Skill's declared SF Express scope, subject to the user's existing OOMOL permissions. ### Impact Assessment This issue does not independently bypass OOMOL authentication. However, it expands the commands that the Agent can invoke with an already authenticated session. Potential impact includes accessing unrelated connector schemas, invoking unrelated connected services, or using administrative CLI functions if such commands are available to the account. The precise scope is constrained by the commands imp ...[truncated 174 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `Bash(oo *)` with the narrowest command patterns supported by the Skill runtime. 2. Permit only `oo connector schema` and `oo connector run`. 3. Enforce `sf_express` as the only accepted connector identifier. 4. Use a dedicated wrapper that parses arguments structurally and rejects shell metacharacters, unexpected flags, alternate connectors, and unsupported subcommands. 5. Maintain an explicit allowlist of SF Express action names. 6. Separate read-only and state-changing action permissions where the runtime supports granular authorization. 7. Avoid implementing restrictions solely through natural-language instructions; enforce them in executable policy or wrapper code. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:46
• Finding: Mutating SF Express Actions Are Misclassified as Safe Read Operations<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 46-51 and 197-199 **Vulnerability Type**: Incomplete mutation tagging that bypasses confirmation controls **Risk Level**: High ### Vulnerable Code The action list contains operations whose descriptions indicate that they append, audit, or report operational state, but some are not tagged as writes: ```text - `freight_append_install_service` — Append an install service to an existing SF waybill. The append is only confirmed once the waybill is picked up; the final result arrives via the install status push. This endpoint requires SF sales onboarding (联系客户经理). - `freight_append_ltl_sub_waybill` — Append sub waybill numbers to an SF Freight LTL order, for shippers who finalize the package count after packing. Only own orders before pickup; at most 1200 sub waybills per order. Reprint the waybills afterwards if they were already printed. - `freight_audit_value_added_service` — Audit a value-added service request (审核增值服务), for example the JZ17 好评返现 service. - `freight_bid_report_add_fee_result` — Report the master's decision on a bidding install order's add-fee request (增加费用结果回传). [write] - `freight_bid_report_complaint_result` — Report the complaint handling result for a bidding install order (接收投诉结果). - `freight_bid_report_operation_node` — Report an operation node for a bidding install order (供应商自主报价操作节点回传). operate_data's required keys depend on operate_code: OP000006 needs installMaster+installConcat, OP000004 needs appTime, OP000008/OP000001/OP000010 need imgUrl, OP000013 needs closeReason. ``` The global safety policy then treats every untagged action as a safe read: ```text - Untagged actions are reads (get / list / search) — safe to run directly. - **Actions tagged `[write]` change SF Express state — confirm the exact payload and effect with the user before running.** - **Actions tagged `[destructive]` remove or overwrite data — always confirm the target and get explicit approval ...[truncated 1770 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Review every action against the authoritative connector contract and tag every state-changing operation as `[write]` or `[destructive]`. 2. Specifically correct untagged actions that append, update, submit, upload, audit, register, send, report, confirm, cancel, or otherwise trigger external effects. 3. Replace the fail-open rule with a fail-closed policy: treat every action as state-changing unless it appears on a verified read-only allowlist. 4. Derive mutability metadata from the connector schema or service definition rather than manually maintained prose where possible. 5. Require explicit confirmation of the target, payload, expected effect, and potential charge before every state-changing action. 6. Add automated tests that reject action lists where known mutating verbs or schema metadata conflict with the assigned safety tag. 7. Revalidate the action classification whenever the upstream SF Express connector contract changes. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The manifest description says to use this skill for ANY SF Express request and instead of calling the API directly, which is an overly broad trigger that can cause automatic invocation in cases where the user did not explicitly ask to use this integration. Because the skill exposes many state-changing and destructive actions, overbroad routing increases the chance of unintended order creation, cancellation, interception, printing, or account-affecting operations.

Static analysis

No suspicious patterns detected.