Tencent Maps

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:08 AM UTC
• Version: 1.0.3

Overview

The skill is mostly coherent for Tencent Maps lookups, but its setup instructions tell users to run an unverified remote installer script directly in a shell.

Before installing, avoid running the pasted curl-to-bash or irm-to-iex commands as-is. Use a reviewed, pinned, or checksum-verified oo CLI installation method, and only sign in or connect Tencent Maps when you intentionally want OOMOL to broker those requests.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66

Finding

Unverified Remote Installation Scripts Executed Directly by a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 66–75
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions download mutable scripts from external URLs and pass them directly to command interpreters. Neither command pins an immutable release, verifies a cryptographic signature or checksum, nor gives the user an opportunity to inspect the downloaded code before execution.

HTTPS protects the connection in transit and authenticates the server at request time, but it does not establish that the returned installer is immutable or benign. A compromise of the publisher, hosting account, release process, DNS or TLS infrastructure—or a malicious upstream modification—could change the effective payload after this Skill has been reviewed.

Installing the CLI is not required for the ordinary declared operation when the prerequisite is already present. Even during initial setup, immediate execution of an unverified remote script exceeds the minimum privilege necessary because safer installation and integrity-verification mechanisms are available.

The audit found no evidence that these scripts are currently malicious. The vulnerability is the creation of an unverified remote code-execution channel.

Attack Path

1. An attacker compromises the installer endpoint, publishing process, hosting account, or relevant network trust infrastructure.
2. The attacker modifies install.sh or install.ps1 to include arbitrary commands.
3. The oo command is unavailable, causing the documented first-time setup path to be used.
4. The user or Agent executes the applicable installation command.
5. The remote response is sent immediately to Bas ...[truncated 928 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all curl | bash and irm | iex installation instructions.

2. Pin installation to a specific, immutable CLI release rather than a mutable installer URL.

3. Download the artifact to a local file without executing it automatically.

4. Publish and verify a cryptographic signature from a trusted release key. If signatures are unavailable, verify a SHA-256 digest obtained through a separately trusted channel.

5. Prefer a reputable package manager that provides version pinning, integrity metadata, and auditable package contents.

6. Present the source, expected filesystem changes, and requested permissions before execution.

7. Require explicit user approval before installing software; do not allow an Agent to initiate installation merely because an action failed.

8. Run installation with the least-privileged account possible and avoid elevation unless a documented component strictly requires it.

9. Document the trusted upstream repository and provide reproducible or otherwise independently verifiable release artifacts.

10. If a script remains necessary, use a safer staged workflow such as:

    bash

    curl -fLo install.sh https://example.invalid/releases/pinned-version/install.sh
    echo "<pinned-sha256>  install.sh" | sha256sum --check -
    less install.sh
    bash install.sh
    

    The actual URL and digest must correspond to a pinned, trusted release, and execution must occur only after successful verification and user approval.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill instructs users to install software by piping a remote script directly into a shell (curl ... | bash), which enables arbitrary code execution if the server, transport, or referenced script is compromised. Because this appears in a troubleshooting/setup path inside the skill, an agent or user following the instructions could execute unreviewed code on the local system.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use this skill for "ANY Tencent Maps request" and "Whenever a task involves Tencent Maps, use this skill," which is an extremely broad activation condition. It does not define scope boundaries, exclusions, or examples of when the skill should not activate, increasing the chance of over-triggering.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.