Stack Internal

• Outcome: Review
• Latest audit: Nov 3, 2026 · 11:50 AM UTC
• Version: 1.0.4

Overview

The search integration fits its stated purpose, but its setup instructions can automatically run unverified installation code on your computer.

Review the automatic setup before installing. Use an explicitly approved, verified CLI release and check its additional skill-sync behavior. Connecting your account lets OOMOL mediate access to private team content. The remote installer and runtime were not inspected; the artifact supports a setup concern, not a finding of malicious intent.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output

Findings (6)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied command performs remote installer execution rather than accessing Stack Internal data. Nothing in the chunk establishes that this installer supports the declared functionality, so it represents a materially different capability and resource access. The contents and further effects of the remote script are not shown.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

## Available actions

- `get_current_user` — Retrieve the user represented by the connected Stack Internal personal access token.
- `get_question` — Retrieve one question from the connected Stack Internal team by ID.
- `list_answers` — List answers for one question in the connected Stack Internal team.
- `list_questions` — List questions from the connected Stack Internal team with optional filters.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Piping an unpinned HTTPS download directly into bash executes whatever script the endpoint supplies without an independent integrity check or review. Compromise of the distribution endpoint could therefore yield arbitrary code execution with the agent's permissions; the PowerShell fallback has the same underlying risk.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

The fallback setup instructs the agent to execute downloaded installation scripts without warning about the system-integrity implications.

Medium

• Category: Output Handling
• Confidence: 95% confidence

Finding

The fallback directs the agent to execute remotely supplied shell or PowerShell code without requiring user approval or verifying the downloaded artifact. Triggering installation only when the CLI is missing limits exposure, but installation still crosses from read-only service access into local code execution with the agent's permissions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.

- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.

## Resources

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

## Resources

- Stack Internal homepage: https://stackoverflow.co/internal/
- API documentation: https://api.stackoverflowteams.com/docs/authentication