StoreCensus

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:56 AM UTC
• Version: 1.0.3

Overview

The skill mostly performs read-only StoreCensus lookups, but its setup instructions tell users to execute an unverified remote installer.

Review the setup section before installing. The StoreCensus connector behavior is narrow and read-oriented, but you should avoid running the pasted remote installer commands unless you independently trust and verify the OOMOL CLI installation source.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58
• Finding: Unverified Remote Installer Download and Immediate Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 58–62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions pipe remotely retrieved content directly into a command interpreter. Neither command pins the installer to an immutable version nor verifies a cryptographic signature or checksum before execution. Consequently, the code that ultimately executes can change after the Skill has been reviewed. If the OOMOL distribution server, DNS resolution, hosting infrastructure, release process, or applicable TLS trust chain is compromised, an attacker could substitute arbitrary shell or PowerShell commands. Those commands would execute with the privileges of the user running the installer. This installation mechanism is not required for the Skill's core StoreCensus query functionality, particularly because the document otherwise assumes that the `oo` CLI is already installed. It therefore exceeds the minimum behavior needed to invoke the connector. The declared tool restriction, `Bash(oo *)`, may prevent an appropriately enforced Agent runtime from executing these installation commands directly, but it does not protect users who copy the instructions manually or environments that fail to enforce that restriction. The network submission performed by `oo connector run` is not independently identified as a vulnerability: sending a query payload to the declared StoreCensus connector is disclosed and necessary for the remote service functionality. No covert credential collection or unrelated data exfiltration was found in the audited file. ### Attack Path 1. The `oo` CLI is absent, or the user encounters a command-not-found error. 2. The user or an insufficiently restr ...[truncated 1351 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove direct `curl | bash` and `Invoke-RestMethod | Invoke-Expression` installation patterns. 2. Prefer installation through a trusted operating-system package manager with a version explicitly selected or pinned. 3. If direct download is necessary: - Download the installer to a local file without executing it. - Pin the download to an immutable release version. - Publish and verify a cryptographic checksum from an independent trusted channel. - Prefer signed release artifacts and verify the publisher's signature. - Allow the user to inspect the downloaded script before execution. 4. Require explicit user approval before installing software or executing any downloaded installer. 5. Keep installation outside the Agent's normal StoreCensus workflow and direct users to a reviewed official installation guide instead. 6. Continue enforcing the `Bash(oo *)` tool restriction so that the Skill can invoke only the installed CLI and cannot run general-purpose download or shell-execution commands. 7. Document the expected installer version, provenance, permissions, and files modified during installation. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (`curl ... | bash`). This creates a supply-chain and remote-code-execution risk: if the install endpoint or network path is compromised, arbitrary code will execute on the host with the user's privileges.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: This markdown file defines when the skill should be invoked, and the activation language is extremely broad. It does not clearly distinguish between cases where the user wants this skill executed versus merely discussing StoreCensus, which could lead to unintended invocation.

Static analysis

No suspicious patterns detected.