Simplesat

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:41 AM UTC
• Version: 1.0.3

Overview

The skill is mainly a Simplesat connector, but its setup instructions can run unverified installer code from the internet, so it should be reviewed before installation.

Review the setup path carefully before installing. The Simplesat connector behavior is understandable, but do not let an agent run the remote installer commands automatically; install the oo CLI from a trusted, pinned, verifiable source and confirm write actions before they run.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote Installer Execution## Vulnerability Details **File Location**: `SKILL.md:62` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a mutable shell script from an external URL and immediately pipes it into Bash. It does not pin the installer to a reviewed version, verify a cryptographic signature or checksum, or provide an opportunity to inspect the downloaded content before execution. Consequently, the effective code executed by this Skill can change after the Skill package has been audited. Although the URL uses HTTPS and its domain is associated with the documented CLI, HTTPS alone does not protect against compromise of the publisher, hosting infrastructure, release process, domain, or trusted TLS environment. Installing the CLI is only a fallback when `oo` is unavailable, not part of ordinary Simplesat connector operations. Automatically executing mutable remote code therefore exceeds the minimum privileges needed for normal Skill functionality. ### Attack Path 1. The `oo` command is unavailable, causing the first-time setup instructions to be used. 2. An attacker compromises the installer publication process, hosting infrastructure, domain resolution, or another trusted delivery component. 3. The attacker replaces or alters `install.sh` with malicious shell commands. 4. `curl` retrieves the current attacker-controlled response. 5. The pipe sends that response directly to Bash without integrity verification or review. 6. The payload executes with the privileges and environment of the user running the command. ### Impact Assessment Successful exploitation provides arbitrary code execution with the invoking user's privileges. The payload could read or modify files accessible to that user, access environment variables and local credentials, ...[truncated 291 chars]
• Remediation: ## Remediation Suggestions - Do not pipe downloaded content directly into a shell. - Pin installation to a specific, reviewed CLI release. - Download the installer or binary to a local file before execution. - Verify a publisher signature and a SHA-256 checksum obtained through an independently protected channel. - Display the source, destination, permissions, and expected system changes before requesting explicit user approval. - Prefer a trusted operating-system package manager or signed release artifact with version pinning. - Run installation with ordinary user privileges unless a documented component strictly requires elevation.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66
• Finding: Unverified PowerShell Installer Execution## Vulnerability Details **File Location**: `SKILL.md:66` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis This instruction retrieves a mutable PowerShell script from an external server and passes it directly to `Invoke-Expression`. The command performs no release pinning, signature validation, checksum verification, or local review before execution. `Invoke-Expression` interprets the downloaded response as PowerShell code in the current session. The executed payload can therefore differ from the content originally assessed with the Skill. HTTPS authenticates the connection under normal conditions but does not eliminate supply-chain risks involving the publisher, release pipeline, hosting account, domain, or trusted delivery infrastructure. This installation channel is broader than the privileges required for normal connector use, which is otherwise limited to `oo` CLI commands. ### Attack Path 1. A Windows environment lacks the `oo` CLI, triggering the first-time setup path. 2. An attacker compromises the remote installer or a trusted part of its delivery chain. 3. The attacker supplies malicious PowerShell in the `install.ps1` response. 4. `Invoke-RestMethod` retrieves the response. 5. The pipeline sends it directly to `Invoke-Expression`. 6. The malicious script executes with the current PowerShell process's user privileges. ### Impact Assessment Exploitation enables arbitrary PowerShell execution as the invoking user. This may expose user-accessible files, environment variables, credentials, and application data and may permit modification of local configuration or installation of additional components. If the user launches PowerShell with elevated privileges, the payload inherits that broader scope. No evidence establishes that the presentl ...[truncated 106 chars]
• Remediation: ## Remediation Suggestions - Remove the `Invoke-RestMethod | Invoke-Expression` pattern. - Pin the CLI to a specific, reviewed release. - Download the PowerShell installer or signed binary separately. - Require a valid Authenticode signature from the expected publisher and verify a published cryptographic checksum before execution. - Present the artifact and intended system changes to the user and obtain explicit approval. - Prefer a signed package delivered through a trusted Windows package manager. - Avoid administrator execution unless a narrowly documented installation step requires it.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs the agent to install software via a remote script piped directly into a shell (`curl ... | bash`), which is a classic supply-chain and arbitrary code execution risk. If the install endpoint, transport, DNS, or upstream distribution is compromised, the agent may execute attacker-controlled code on the host without inspection or integrity verification.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The phrase "Use this skill for ANY Simplesat request" is extremely broad and could match a wide range of ordinary Simplesat-related discussion, not just clear action requests. The description does not provide negative examples or tighter constraints on when to invoke the skill versus when not to.

Static analysis

No suspicious patterns detected.