Security audit

Sorftime MCP

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a Sorftime data connector, but it under-labels a deletion-capable tool and includes unverified remote installer commands users should review carefully.

Install only if you are comfortable with the OOMOL CLI and Sorftime account access. Before using `call_tool`, inspect the selected tool schema and require explicit confirmation for any favorite change, deletion, overwrite, or credit-consuming action. Avoid piping remote installer scripts directly into a shell; prefer a pinned or signed install method where available.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:91
Finding: Unverified Remote Installer Is Executed Directly by the Shell## Vulnerability Details **File Location**: `SKILL.md`, lines 91-95 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from an external server and immediately execute them with Bash or PowerShell. Neither command pins a reviewed release nor verifies a cryptographic checksum or digital signature before execution. HTTPS protects the connection in transit but does not establish that the current contents of the remote installer are identical to those reviewed during this audit. Compromise of the referenced domain, DNS infrastructure, hosting environment, release pipeline, or installer itself would allow the delivered payload to change without any modification to this Skill. Directly piping the response into a command interpreter also prevents meaningful inspection before execution. Installing the CLI may be necessary for the declared connector functionality, but executing unverified remote content is not the minimum privilege or safest installation method required to accomplish that task. ### Attack Path 1. The `oo` CLI is absent, causing an action to fail with `oo: command not found`. 2. The Agent or user follows the documented first-time setup procedure. 3. An attacker compromises or otherwise controls the remote installer response. 4. `curl` or `irm` retrieves the attacker-controlled script. 5. The pipe to `bash` or `iex` executes the response immediately, without integrity verification or review. 6. The payload performs arbitrary operations using the privileges and environment of the invoking process. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privil ...[truncated 579 chars]
Remediation: ## Remediation Suggestions - Remove all direct `curl | bash` and `irm | iex` installation instructions. - Pin installation to a specific, reviewed CLI release rather than a mutable installer endpoint. - Download the installer or package to a local file before execution. - Publish and require verification of a cryptographic checksum or, preferably, a trusted digital signature. - Display the resolved version, source, and verification result and obtain explicit user approval before executing an installer. - Prefer signed packages distributed through reputable platform package managers. - Run installation with ordinary user privileges unless a specific operation demonstrably requires elevation. - Document the files, directories, network endpoints, and permissions used by the installer.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:49
Finding: Destructive Nested Tool Capability Is Incorrectly Classified as a Safe Read## Vulnerability Details **File Location**: `SKILL.md`, line 49 and lines 81-83 **Vulnerability Type**: Unsafe action classification and missing confirmation enforcement **Risk Level**: Medium ### Vulnerable Code ```text - `call_tool` — Run a tool from list_tools with its required arguments. Supports research queries and changes to favorites, including deletion. Credit cost depends on the tool. ``` The applicable safety policy states: ```text - Untagged actions are reads (get / list / search) — safe to run directly. - **Actions tagged `[write]` change Sorftime MCP state — confirm the exact payload and effect with the user before running.** - **Actions tagged `[destructive]` remove or overwrite data — always confirm the target and get explicit approval first.** ``` ### Technical Analysis The `call_tool` action explicitly supports state changes and deletion, but it is not marked with either the `[write]` or `[destructive]` tag. The Skill simultaneously instructs the Agent to treat every untagged action as a read that is safe to run directly. This creates a policy mismatch: the outer connector action appears harmless under the Skill's tagging convention even though the nested tool selected at runtime may mutate or delete account data. Fetching a live schema does not by itself correct this issue because the documented confirmation requirement is driven by the missing action tag. ### Attack Path 1. A request causes the Agent to select the untagged `call_tool` action. 2. The Agent follows the Skill's rule that untagged actions are safe read operations. 3. A nested tool capable of changing favorites or deleting data is selected. 4. The Agent constructs and sends the payload without obtaining the confirmation required for destructive actions. 5. Sorftime MCP performs the remote mutation or deletion under the connected user's account. ### Impact Assessment Exploitation may cause unauthorized modification or delet ...[truncated 427 chars]
Remediation: ## Remediation Suggestions - Mark `call_tool` as `[write]` and potentially `[destructive]` because its nested behavior can mutate or delete data. - Do not infer safety solely from the outer action name or tag. Inspect the selected nested tool's schema and declared effects before every invocation. - Require explicit user confirmation for the exact target, operation, payload, and expected effect of every state-changing nested tool. - Require a second, unambiguous confirmation for deletion or overwrite operations. - Separate read-only and state-changing nested operations into distinct connector actions where possible. - Implement server-side authorization and confirmation controls rather than relying exclusively on prose instructions. - Return or display a dry-run summary before executing destructive operations. - Update the safety rule so unknown or dynamically dispatched actions default to confirmation rather than being treated as reads.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest and description present the skill as limited to searching and reading data, but the documented `call_tool` action can perform state changes and deletions. This mismatch can cause downstream agents or users to invoke the skill under a false read-only assumption, increasing the chance of unintended write or destructive operations.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: `call_tool` is listed as an untagged action even though its description explicitly says it can perform changes to favorites, including deletion. Because the document also teaches that only tagged actions are mutating, an agent may treat `call_tool` as safe and execute destructive operations without confirmation.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The safety section says untagged actions are reads that are safe to run directly, but `call_tool` remains untagged while being capable of deletion-capable operations. This creates a direct unsafe instruction path: the policy text can cause an autonomous agent to bypass confirmation checks for an action that may mutate or delete state.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The instruction to use this skill for 'ANY Sorftime MCP request' is overly broad and may cause the skill to be selected for loosely related tasks without sufficient scrutiny. In context, this is more dangerous because the skill is not actually read-only and includes a generic `call_tool` mechanism that can invoke account tools with side effects.

Static analysis

No suspicious patterns detected.