Stormboard

• Outcome: Review
• Latest audit: Sep 15, 2026 · 6:09 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a coherent Stormboard read-only connector, but its setup instructions include direct remote installer execution that users should review before installing.

Before installing, review OOMOL's official installation process and prefer a verified package or installer with a checksum or signature instead of piping a downloaded script directly into a shell. Routine Stormboard use appears limited to read actions through the oo CLI, but it sends requests through OOMOL and requires an OOMOL-connected Stormboard account.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64
• Finding: Unverified Remote Installer Downloaded and Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 64–68 **Vulnerability Type**: Remote payload retrieval and execution through pipe-to-shell installation commands **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from `cli.oomol.com` and immediately execute them using Bash or PowerShell. Neither command pins a specific installer version, verifies a cryptographic checksum or signature, nor gives the user an opportunity to inspect the downloaded content before execution. HTTPS protects the connection in transit but does not establish that the remote script is immutable or safe. The effective code can change after the Skill has been audited. Compromise of the hosting account, domain, TLS delivery infrastructure, or installer publication process could therefore turn these installation instructions into an arbitrary-code-execution channel. This behavior is not required during ordinary Skill operation because the documentation assumes that the `oo` CLI is already installed. Installing the CLI may be necessary when it is absent, but direct pipe-to-shell execution exceeds the minimum safe mechanism needed to perform that installation. The declared tool restriction, `Bash(oo *)`, may prevent a conforming Agent from directly invoking these installer commands; however, the unsafe instructions remain present and may be followed manually or in an environment that does not enforce that restriction. ### Attack Path 1. A user or Agent attempts to perform a Stormboard action and receives an `oo: command not found` error. 2. The first-time setup section directs the user or Agent to fetch an installation script from `cli.oomol.com`. 3. An attacker compromises the installer host, publication pipeline, DNS or ...[truncated 1574 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove both pipe-to-shell installation commands from the Skill instructions. 2. Direct users to an official, reviewable installation guide or a trusted platform package manager. 3. Pin installation artifacts to a specific CLI release rather than a mutable installer endpoint. 4. Download the artifact as a separate step and verify a publisher-provided cryptographic signature or checksum before execution. 5. Publish checksums through an independently protected release channel and fail closed if verification does not succeed. 6. Require explicit user approval before installing software or running any downloaded executable. 7. Display the artifact source, version, expected digest, and intended filesystem changes before installation. 8. Prefer a restricted, non-administrative installation and document any permissions that are genuinely required. 9. Keep installation outside routine Skill execution; when the CLI is unavailable, return a clear error and let the user complete a verified installation manually. 10. If installer scripts remain available, use versioned immutable URLs and retain auditable source and release provenance. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software by piping a remotely fetched script directly into a shell (`curl ... | bash`). If the remote host, distribution path, or transport is compromised, this results in immediate arbitrary code execution on the user's machine without an opportunity to inspect the script first.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The description says to use this skill for "ANY Stormboard request" and "Whenever a task involves Stormboard," which is a very broad activation condition. It does not define boundaries, exclusions, or negative examples, so the skill could be invoked for loosely related mentions of Stormboard rather than clearly intended cases.

Static analysis

No suspicious patterns detected.