Supervisely

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:54 AM UTC
• Version: 1.0.2

Overview

The skill’s normal Supervisely actions are read-only and coherent, but its first-time setup tells users to run unverified remote installer scripts directly in a shell.

Review before installing. The read-only Supervisely connector behavior is clear, but only run the oo CLI installer if you trust OOMOL’s installer source and are comfortable executing a live remote script on your machine; prefer a verified or package-managed install path if available.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:57
• Finding: Unverified Remote Installer Download and Immediate Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 57–66 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable code:** ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions download mutable scripts from an external server and pass them directly to command interpreters. The Unix command pipes the HTTP response into Bash, while the Windows command evaluates the response through PowerShell's `Invoke-Expression`. No immutable version, cryptographic checksum, digital-signature verification, or separate review step is provided. Consequently, the code that executes may differ from the code available when the skill was audited. Although the host belongs to the stated CLI vendor and setup is only recommended after a command-not-found error, these facts do not establish the integrity of the retrieved payload. Direct execution is not necessary for the skill's declared read-only Supervisely functionality. A verified, version-pinned CLI artifact could provide the same functionality with substantially lower supply-chain risk. ### Attack Path 1. A user requests a Supervisely operation. 2. The agent attempts to invoke `oo`, but the CLI is unavailable. 3. Following the first-time setup instructions, the agent executes one of the remote installation commands. 4. The command retrieves the current installer from `cli.oomol.com`. 5. The downloaded response is executed immediately without integrity or authenticity verification. 6. If the hosting service, publication pipeline, domain, DNS/TLS trust chain, or installer content has been compromised, attacker-controlled commands execute under the invoking user's account. ### Impact Assessment A malicious installer could execute arbitrary commands with all p ...[truncated 667 chars]
• Remediation: ## Remediation Suggestions - Remove direct `curl | bash` and `irm | iex` installation instructions. - Prefer an authenticated operating-system package repository or another official package manager that verifies signed metadata and artifacts. - Pin the CLI to a reviewed, immutable release version rather than retrieving a mutable installer. - If a standalone artifact is required, download it to disk without executing it, verify its vendor signature and a trusted, pinned SHA-256 digest, and only then run it. - Publish checksums and signatures through an independently authenticated release channel. - Require explicit user approval before installing software or executing any downloaded installer. - Run installation with ordinary user privileges unless elevation is demonstrably required, and clearly disclose any requested permissions. - Apply equivalent integrity controls to both the Unix and Windows installation paths.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users to install the CLI via a remote script piped directly into bash, which executes unreviewed code fetched at runtime from the network. If the hosting endpoint, transport path, or script is compromised, this becomes an immediate arbitrary code execution vector on the user's machine.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation text is unusually broad: it directs the agent to use this skill for ANY Supervisely request and whenever a task involves Supervisely. That can cause unintended invocation on vague mentions of Supervisely, increasing the chance the agent routes requests through this skill unnecessarily and follows its operational guidance instead of using narrower, task-specific logic.

Static analysis

No suspicious patterns detected.