Square

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:06 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent for managing Square through OOMOL, but its setup instructions include unverified remote scripts that could execute arbitrary local code if followed.

Review the first-time setup before installing. Prefer installing the oo CLI from a verified, versioned, checksum- or signature-checked source, and avoid running the curl-to-bash or irm-to-iex commands as an administrator. For normal use, confirm every Square write payload before allowing create or update actions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60
• Finding: Unverified Remote Installation Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 60–64 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable scripts from an external server and immediately execute them using Bash or PowerShell. Neither command pins the downloaded artifact to a specific version nor verifies a cryptographic signature or expected checksum before execution. Consequently, the code ultimately executed is not limited to the content reviewed in this Skill. If the distribution server, hosted script, DNS resolution, certificate issuance process, or publishing account is compromised, the fetched response can contain arbitrary commands. Immediate piping also prevents meaningful inspection before execution. Installing the CLI may be necessary for the declared Square connector functionality, but direct execution of an unverified network response exceeds the minimum safe mechanism required to perform that installation. ### Attack Path 1. The `oo` command is unavailable, causing the user or agent to follow the first-time setup instructions. 2. An attacker compromises the remote installation endpoint or its publication infrastructure, or otherwise gains the ability to serve a malicious script from the trusted URL. 3. The installation command downloads the attacker-controlled response. 4. Bash or PowerShell immediately interprets the response as executable code without integrity verification. 5. The payload executes with all permissions held by the user running the installation command. 6. The payload can access or modify resources available to that user and may install additional components or steal accessible credentials. ### Impact Asse ...[truncated 855 chars]
• Remediation: ## Remediation Suggestions 1. Remove direct `curl | bash` and `irm | iex` execution patterns. 2. Prefer a version-pinned package distributed through a trusted package manager. 3. If scripts must be used, download them to a local file without executing them: ```bash curl --fail --show-error --location --output install.sh https://cli.oomol.com/install.sh ``` 4. Publish an expected SHA-256 digest through an independently protected release channel and verify it before execution: ```bash echo "<EXPECTED_SHA256> install.sh" | sha256sum --check ``` 5. Cryptographically sign release artifacts and verify the signature against a documented, pinned publisher key. 6. Pin installation instructions to a specific immutable CLI release rather than a mutable generic installer URL. 7. Allow users to inspect the downloaded script before running it explicitly. 8. Document that installation must use a non-administrative account unless elevated privileges are demonstrably required. 9. Apply equivalent download, version-pinning, signature, and digest-verification controls to the PowerShell installer.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Credential Access

High

• Category: Privilege Escalation

Content

- `create_customer` — Create a Square customer profile. [write]
- `get_customer` — Retrieve one Square customer profile by ID.
- `list_customers` — List Square customer profiles with cursor pagination.
- `list_locations` — List Square seller locations for the connected access token.
- `search_customers` — Search Square customer profiles with supported Square filters.
- `update_customer` — Update a Square customer profile by ID. [write]

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill includes a classic pipe-to-shell installation command that fetches and executes a remote script without integrity verification. If the install endpoint, transport path, or hosting account is compromised, an agent following these instructions could execute attacker-controlled code on the host environment.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The trigger text is overly broad because it directs the agent to use this skill for ANY Square-related request, without constraining by task type, sensitivity, or user intent. That can cause unintended invocation on loosely related prompts and increase the chance of unnecessary access to customer or account data, especially since the skill supports both read and write actions.

Static analysis

No suspicious patterns detected.