Statsig

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:42 AM UTC
• Version: 1.0.2

Overview

The skill is a disclosed read-only Statsig connector through OOMOL, but its setup path recommends directly executing remote installer scripts and it broadly routes Statsig reads through OOMOL.

Install only if you are comfortable sending Statsig read requests and responses through OOMOL. Avoid running the shown curl | bash or irm | iex installer commands from the skill as-is; prefer a verified, signed, or package-manager installation path for the oo CLI and confirm your OOMOL account and Statsig connection scopes before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61
• Finding: Unverified Remote Installation Scripts Executed Directly by Shells<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 61-65 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions pipe remotely retrieved content directly into Bash or PowerShell. The effective executable payload is not contained in the reviewed project and can change after the Skill has been audited. Neither command pins a script version nor verifies a cryptographic digest or publisher signature before execution. HTTPS protects the connection in transit under normal conditions, but it does not protect users if the remote server, publishing account, installation infrastructure, or trusted certificate path is compromised. Installation is relevant when the required CLI is unavailable, but immediate execution of mutable remote content is not the minimum privilege or safest mechanism necessary to install it. A downloaded, version-pinned, and independently verified artifact would provide the same functionality with substantially less risk. ### Attack Path 1. The Agent attempts to use the Skill on a system where the `oo` command is unavailable. 2. The documented fallback directs the user or Agent to retrieve the installation script from `cli.oomol.com`. 3. An attacker compromises the remote installation script, its hosting infrastructure, or another trusted component in the delivery path. 4. `curl | bash` or `irm | iex` passes the attacker-controlled response directly to a command interpreter. 5. The malicious commands execute with the privileges of the account running the installation. 6. The payload can access that account's files, environment variables, active credentials, and available network resources, and could attempt persistence or further compromise ...[truncated 792 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove both direct download-to-interpreter pipelines. 2. Publish versioned installation artifacts through a trusted release channel. 3. Pin the CLI to a specific reviewed version rather than installing the latest mutable release. 4. Download the artifact to disk without executing it automatically. 5. Verify a publisher signature or a SHA-256 digest obtained through an independently protected channel. 6. Abort installation if verification fails. 7. Display the artifact version, source, and expected privileges, and require explicit user approval before installation. 8. Prefer a signed operating-system package or established package manager where available. 9. Avoid elevated installation unless it is strictly required, and document which files and directories the installer will modify. A safer conceptual workflow is: ```bash curl -fSLO "https://trusted.example/releases/<pinned-version>/oo-cli.tar.gz" echo "<expected-sha256> oo-cli.tar.gz" | sha256sum --check - # Inspect or install the verified artifact only after explicit approval. ``` The actual release URL and digest must come from the publisher's authenticated, version-specific release process. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:3
• Finding: Unconditional Third-Party Routing of Statsig Requests and Responses<; OOMOL injects credentials server-side, so you never handle raw tokens. ``` ```bash oo connector schema "statsig" --action "<action_name>" ``` ```bash oo connector run "statsig" --action "<action_name>" --data '<json>' --json ``` ### Technical Analysis The Skill explicitly instructs the Agent to use OOMOL for “ANY” Statsig request instead of allowing normal tool selection or direct access to Statsig. The connector command necessarily transmits request payloads to OOMOL infrastructure and returns Statsig data through that infrastructure. This routing is disclosed and is related to the Skill's declared connector functionality. The reviewed content also states that credentials are injected server-side rather than exposed as raw tokens. Nevertheless, the unconditional instruction can alter the Agent's tool-selection behavior whenever a task involves Statsig, including cases where the user did not specifically request third-party processing. The broad instruction may exceed least privilege because it does not limit routing to the minimum fields needed for a particular operation, require informed consent before third-party transmission, or permit direct Statsig access where that would reduce data exposure. ### Attack Path 1. A user asks the Agent to search or retrieve information from a connected Statsig project. 2. Loading the Skill introduces the instruction to rout ...[truncated 1524 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the directive to use the Skill for “ANY” Statsig request with narrowly scoped activation criteria. 2. Invoke the OOMOL connector only when the user explicitly requests OOMOL integration or has previously provided informed consent. 3. Clearly disclose that request parameters and Statsig responses pass through OOMOL infrastructure. 4. Document the categories of transmitted data, retention and logging practices, processing locations, and applicable access controls. 5. Permit direct Statsig API access when available and when it reduces unnecessary third-party exposure. 6. Minimize request payloads to the exact fields required by the selected action. 7. Avoid including unrelated user content, secrets, or personal information in connector payloads. 8. Enforce server-side authorization so the connector can perform only the documented read actions and access only the intended Statsig project. 9. Provide administrators with audit logs and controls for revoking the OOMOL-to-Statsig connection. 10. Ensure users can inspect and approve sensitive payloads before transmission where project data is confidential. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users to install the CLI via a remote script piped directly into bash, which executes network-fetched code without prior verification. If the distribution server, transport path, or script content is compromised, this can lead to arbitrary code execution on the user's machine.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill description instructs the agent to use this skill for "ANY Statsig request" and to prefer it over direct API access, which creates an overly broad routing rule without narrowing to specific read-only or low-risk operations. Broad triggers increase the chance the skill is invoked in unintended contexts, including sensitive or state-changing Statsig workflows, and can bypass more appropriate, task-specific safeguards.

Static analysis

No suspicious patterns detected.