Streak

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:42 AM UTC
• Version: 1.0.3

Overview

This Streak skill is mostly coherent, but it asks users or agents to use an unsafe remote installer and grants broader CLI authority than its read-only Streak purpose requires.

Review before installing. This skill may be acceptable if you already trust OOMOL with your Streak data and install the oo CLI through a safer verified method. Avoid running the inline curl|bash or irm|iex installer commands, and prefer a narrower tool permission than Bash(oo *) if your environment supports it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58
• Finding: Unverified Remote Shell Installer Execution## Vulnerability Details **File Location**: `SKILL.md`, line 58 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes content downloaded from an external URL directly into Bash. The effective code is mutable and is executed before the user or Agent can inspect it. The instruction does not pin an installer version or require verification through a cryptographic signature or published checksum. HTTPS protects the connection in transit but does not establish that the current remote payload is trustworthy or immutable. Compromise of the hosting infrastructure, domain, DNS, TLS issuance, deployment process, or installer account could replace the script after this Skill has been reviewed. Installing the CLI is only conditionally necessary when it is absent. Executing an unverified remote script is not the minimum privilege or minimum-risk mechanism required to provide Streak read access. ### Attack Path 1. An attacker compromises the installer hosting environment, deployment credentials, domain, DNS resolution, or another part of the remote delivery chain. 2. The attacker replaces `install.sh` with a malicious payload. 3. The Agent encounters an `oo: command not found` error and follows the first-time setup instructions. 4. `curl` retrieves the attacker-controlled content. 5. The shell pipeline passes that content directly to Bash without verification or review. 6. The payload executes with all permissions available to the Agent or current user. ### Impact Assessment Successful exploitation provides arbitrary command execution under the current user's privileges. Depending on those privileges and the malicious payload, an attacker could access local files and environment variables, steal credentials, modify user-owned data, install ...[truncated 100 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `curl | bash` installation method. - Distribute a version-pinned release through a trusted package manager or an official signed release repository. - Download the installer or binary to a local file before execution. - Verify it using a cryptographic signature or a checksum obtained through a separately authenticated channel. - Display the resolved version and source to the user and require explicit approval before installing software. - Run installation with ordinary user privileges unless elevated access is demonstrably required. - Prefer documented manual installation steps that provide an inspection boundary before execution.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote PowerShell Installer Execution## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis `irm` retrieves text from a mutable external URL and sends it directly to `iex`, which evaluates the response as PowerShell code. There is no local review boundary, version pin, checksum validation, Authenticode signature check, or other integrity verification. This is the PowerShell equivalent of piping a remote installer directly into a shell. The code ultimately executed can change after the Skill package has been audited, so the package review does not establish the safety of the runtime payload. ### Attack Path 1. An attacker gains control of the hosted PowerShell installer or another component of its delivery chain. 2. The attacker modifies `install.ps1` to contain arbitrary PowerShell commands. 3. A Windows user or Agent follows the first-time setup instruction after the `oo` command is unavailable. 4. `Invoke-RestMethod` retrieves the modified response. 5. `Invoke-Expression` immediately evaluates the response in the active PowerShell session. 6. The malicious commands execute with the permissions and accessible credentials of that session. ### Impact Assessment Exploitation permits arbitrary PowerShell execution under the current user's security context. Potential consequences include access to user files and process environment data, credential theft, modification of local data, execution of secondary payloads, persistence installation, and lateral activity through resources available to the compromised account.
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` pattern. - Provide a signed, version-pinned package through a trusted Windows package manager or official release channel. - Download the package to disk without evaluating it. - Verify an Authenticode signature and a published cryptographic checksum before installation. - Require explicit user approval after showing the package source, version, permissions, and verification result. - Avoid administrative execution unless installation specifically requires it. - If a script remains necessary, make it inspectable before execution and fail closed when integrity verification is unavailable.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:2
• Finding: Overly Broad CLI Authorization and Third-Party Routing of Streak Data## Vulnerability Details **File Location**: `SKILL.md`, lines 2-4 and 27-31 **Vulnerability Type**: Excessive tool authorization and third-party data routing **Risk Level**: Medium **Relevant Code**: ```yaml name: oo-streak description: "Streak (streak.com). Use this skill for ANY Streak request — searching and reading data. Whenever a task involves Streak, use this skill instead of calling the API directly." allowed-tools: [Bash(oo *)] ``` ```bash oo connector run "streak" --action "<action_name>" --data '<json>' --json ``` ### Technical Analysis The Skill grants Bash access to the broad command pattern `oo *`, although its declared functionality only requires a limited set of connector schema queries and read-only Streak connector actions. The authorization therefore covers every available or future `oo` subcommand rather than narrowly restricting execution to the documented Streak operations. The instruction also directs every Streak request through OOMOL. Request payloads and returned CRM information are consequently processed by an intermediary rather than being exchanged directly with Streak. This network transfer is part of the stated connector design and is not hidden; however, it expands the data-processing trust boundary and may expose sensitive customer, pipeline, box, and user information to an additional service. The package contains no evidence that raw credentials are read locally; it states that OOMOL injects credentials server-side. The finding concerns broad command authority and expanded data exposure, not confirmed raw-token theft. ### Attack Path 1. A task involving Streak loads the Skill and activates the instruction to route all Streak requests through OOMOL. 2. The Agent receives authorization matching any command beginning with `oo`, rather than only the required connector schema and read-only run commands. 3. Request parameters are supplied to the OOMOL connector, and Streak r ...[truncated 790 chars]
• Remediation: ## Remediation Suggestions - Replace `Bash(oo *)` with the narrowest tool rules supported by the host framework. - Permit only the exact schema command and the four documented read-only Streak actions. - Reject arbitrary connector names, action names, and unrelated `oo` subcommands. - Validate action names against an explicit allowlist before execution. - Clearly disclose that request payloads and Streak responses are processed by OOMOL. - Obtain informed user approval before transmitting sensitive CRM data through an intermediary when that routing is not already expected. - Document retention, logging, encryption, subprocessors, and access-control policies for connector data. - Minimize payload fields and avoid transmitting unrelated sensitive information.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill includes a `curl ... | bash` installation command that downloads and immediately executes a remote script. If the host, transport, or served script is compromised, this leads to arbitrary code execution on the user's machine, and the skill context makes it more dangerous because it presents the command as a built-in operational fallback during tool use.

Vague Triggers

Medium

• Confidence: 98% confidence
• Finding: The skill description says to use this skill for ANY Streak request and instead of calling the API directly, which is an overly broad routing trigger. That can cause the agent to invoke this skill in contexts beyond simple read operations, increasing the chance of unnecessary tool use, unexpected data access, or bypass of more context-appropriate safeguards.

Static analysis

No suspicious patterns detected.