Storyblok

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:15 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a coherent Storyblok connector guide, but its fallback setup tells users to execute unverified remote installer scripts, which is high-impact enough to require Review.

Install only if you are comfortable with OOMOL-mediated access to your Storyblok space and avoid the one-line remote installer commands unless you independently verify the official installer, version, and integrity first. Treat the available actions as read-only based on this artifact, and require explicit confirmation before any future connector action that changes Storyblok content or account state.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61
• Finding: Unverified Remote Installer Executed Through Bash## Vulnerability Details **File Location**: `SKILL.md`, line 61 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes a mutable remote response directly into Bash. The payload is neither pinned to a specific release nor verified with a cryptographic checksum or publisher signature. It also cannot be inspected before execution. HTTPS protects the connection in transit but does not establish that every future script served by the endpoint is safe. Compromise of the hosting infrastructure, publishing account, or installer supply chain could change the effective payload after the Skill has been reviewed. The fallback instruction therefore establishes an arbitrary code-execution channel outside the audited package. Although installation is relevant when the required CLI is absent, immediate execution of unverified remote code exceeds the minimum privilege necessary to explain or facilitate installation. Installation should also require explicit user authorization because it can make system-level changes. ### Attack Path 1. The `oo` CLI is unavailable and an invocation fails with `oo: command not found`. 2. The agent or user follows the documented first-time setup instruction. 3. `curl` retrieves the current contents of `https://cli.oomol.com/install.sh`. 4. The response is passed directly to Bash without local inspection or integrity verification. 5. If the remote endpoint or release process has been compromised, attacker-controlled shell commands execute with the privileges of the account running the command. ### Impact Assessment Successful exploitation grants arbitrary command execution under the invoking user's privileges. The payload could read accessible files and credentials, alter project or user configuration, inst ...[truncated 175 chars]
• Remediation: ## Remediation Suggestions - Do not pipe downloaded content directly into a shell. - Pin installation to a specific, reviewed CLI release from an authenticated official release channel. - Download the installer or binary to a local file without executing it. - Verify a documented SHA-256 digest and, preferably, a publisher signature before execution. - Allow the user to inspect the downloaded artifact and describe the expected filesystem and configuration changes. - Require explicit user approval immediately before installation. - Run installation with the least-privileged account possible and avoid privilege elevation unless a specific, explained step requires it. - Prefer a trusted operating-system package manager or signed package with version pinning where available.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:65
• Finding: Unverified Remote Installer Executed Through PowerShell## Vulnerability Details **File Location**: `SKILL.md`, line 65 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Vulnerable Code**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis This instruction retrieves a mutable PowerShell script with `Invoke-RestMethod` (`irm`) and immediately evaluates the response with `Invoke-Expression` (`iex`). No fixed release, cryptographic digest, digital-signature validation, or review step is specified. Consequently, the executed code is determined by the remote server at installation time rather than by the audited Skill package. If the hosting service, publishing credentials, or upstream delivery process is compromised, the endpoint can return arbitrary PowerShell code. Immediate evaluation gives that code the full effective permissions of the current PowerShell process. Installing the required CLI may be functionally relevant, but direct evaluation of unverified network content is not the least-privileged installation method and should never occur without explicit user approval. ### Attack Path 1. The `oo` CLI is missing on a Windows host and an attempted action fails. 2. The agent or user follows the documented PowerShell setup command. 3. `irm` downloads the current response from `https://cli.oomol.com/install.ps1`. 4. The response is sent directly to `iex`, with no integrity or authenticity check beyond transport security. 5. A compromised endpoint or release process supplies attacker-controlled PowerShell. 6. PowerShell executes the payload with the invoking process's privileges. ### Impact Assessment Exploitation permits arbitrary PowerShell execution as the invoking user. An attacker could access readable documents and credentials, change user or system configuration, download further payloads, tamper with command-line tools, or create persistence. Execution f ...[truncated 74 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm ... | iex` installation pattern. - Pin the CLI to a specific reviewed version and distribute it through an authenticated, official release channel. - Download the installer to disk first rather than evaluating its network response. - Validate an Authenticode signature or a separately published cryptographic checksum before execution. - Present the artifact, version, publisher, and expected changes to the user. - Obtain explicit user approval immediately before running the installer. - Use a non-elevated PowerShell process unless a clearly identified installation operation requires elevation. - Prefer a signed Windows package or trusted package-manager source with version pinning.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Credential Access

High

• Category: Privilege Escalation

Content

## Available actions

- `get_space` — Retrieve metadata for the Storyblok space associated with the access token.
- `get_story` — Retrieve one Storyblok story by full slug, numeric ID, or UUID.
- `list_datasource_entries` — List Storyblok datasource entries, optionally filtered by datasource and dimension.
- `list_datasources` — List Storyblok datasources with pagination.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users to install software by piping a remote script directly into bash. If the hosting site, network path, or script content is compromised, this results in immediate arbitrary code execution on the user's machine.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest says the skill is for 'searching and reading data', but the body explicitly discusses possible [write] and [destructive] actions. That mismatch can mislead an agent or reviewer about the skill's true capabilities, increasing the chance of unsafe invocation or reduced scrutiny for state-changing operations.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger language 'ANY Storyblok request' and 'Whenever a task involves Storyblok' is overly broad and can cause the skill to be invoked in situations where direct use is unnecessary or where user intent is ambiguous. Overbroad routing increases attack surface and can lead to unintended access to connected tenant data.

Intent-Code Divergence

Low

• Confidence: 80% confidence
• Finding: The document tells the agent to trust tagging to distinguish safe reads from writes, but the listed actions shown here have no actual [write] or [destructive] tags. That ambiguity can cause an agent to assume an action is safe when the documentation is incomplete or stale, weakening safeguards around mutations.

Static analysis

No suspicious patterns detected.