TheirStack

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:07 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a read-only TheirStack connector, but its setup path recommends directly executing remote installer scripts.

Before installing, use safer oo CLI installation guidance where possible: prefer an official package manager or a downloaded, versioned installer that you can verify and inspect. Do not run the curl-to-bash or irm-to-iex commands from an elevated shell unless you intentionally accept the risk of executing remote installer code.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58
• Finding: Unverified Remote Bash Installer Is Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, line 58 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes a remotely downloaded script directly into Bash. The payload is mutable and is not version-pinned, checksum-validated, cryptographically signature-verified, or available within the audited package for inspection. HTTPS protects the connection in transit, but it does not protect against compromise of the hosting service, publisher account, or installer infrastructure. It also does not guarantee that the script reviewed today will be the script served later. The `-f` and `-s` options can further reduce useful visibility when failures occur. Installing the required CLI can be necessary for the declared TheirStack integration. However, immediately executing an unverified remote response exceeds the minimum safely necessary installation behavior. ### Attack Path 1. The `oo` CLI is absent, causing the user or Agent to follow the first-time setup instructions. 2. An attacker compromises the installer host, publishing account, delivery infrastructure, or remote installation script. 3. `curl` retrieves the attacker-controlled response from the mutable URL. 4. The shell pipe passes that response directly to Bash without integrity or authenticity verification. 5. Bash executes the attacker-controlled commands with all permissions available to the invoking user. ### Impact Assessment Successful exploitation provides arbitrary command execution in the context of the user running the installation command. The payload could read or modify user-accessible files, access credentials available to the process, install additional software, alter shell configuration, or establish persistence. If the command is run from a privileged account or the retrie ...[truncated 102 chars]
• Remediation: ## Remediation Suggestions Remove the direct `curl | bash` installation instruction. Prefer an authenticated operating-system package manager or a pinned, versioned release artifact from the official publisher. If a standalone installer is necessary: 1. Download it to a non-executable temporary file without invoking a shell. 2. Require a specific version rather than a mutable installation endpoint. 3. Verify a publisher signature and a SHA-256 checksum obtained through an authenticated, independent release channel. 4. Present the verified script for inspection before execution. 5. Execute it with an unprivileged account and avoid automatic privilege elevation. 6. Document the files, permissions, and network access required by the installer. 7. Remove the downloaded artifact after successful installation.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote PowerShell Installer Is Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The instruction uses `Invoke-RestMethod` (`irm`) to retrieve a mutable PowerShell script and sends its response directly to `Invoke-Expression` (`iex`). `Invoke-Expression` evaluates the downloaded text as PowerShell code without pinning the version, validating a checksum, verifying an Authenticode signature, or allowing prior inspection. As a result, the effective code executed by this Skill is controlled by content served after the package audit. TLS alone does not establish the long-term integrity of that content. This creates a remote code-execution supply channel that is broader than necessary to install the declared CLI dependency safely. ### Attack Path 1. The `oo` CLI is unavailable on a Windows system. 2. The user or Agent follows the documented first-time setup command. 3. An attacker compromises the remote script, its hosting account, or the associated delivery infrastructure. 4. `Invoke-RestMethod` obtains the attacker-controlled PowerShell content. 5. The pipeline forwards the content to `Invoke-Expression`. 6. PowerShell executes the content with the invoking process's permissions and security context. ### Impact Assessment Successful exploitation allows arbitrary PowerShell execution under the invoking user's account. An attacker could access user-readable data and credentials, modify files and PowerShell profiles, download additional payloads, alter security settings available to the account, or create persistence mechanisms. Execution from an elevated PowerShell session would expose administrative resources and could result in system-wide compromise.
• Remediation: ## Remediation Suggestions Remove the `irm | iex` instruction. Distribute the CLI through a trusted Windows package manager or provide a versioned installer with verifiable publisher provenance. If PowerShell-based installation must remain: 1. Download the script to a local file without evaluating it. 2. Pin the download to an explicit, immutable release version. 3. Validate a separately published SHA-256 checksum. 4. Require a valid Authenticode signature from the documented publisher. 5. Review the script before running it. 6. Execute it from a non-administrative PowerShell session unless elevated privileges are demonstrably necessary. 7. Avoid `Invoke-Expression` and invoke only the verified local artifact.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users to install software by piping a remotely fetched script directly into `bash`, which is a well-known unsafe pattern because it executes unverified code from the network with the user's privileges. If the install endpoint, transport, upstream distribution pipeline, or DNS/TLS trust chain were compromised, the user could be induced to run arbitrary attacker-controlled code; in a skill context, this is more dangerous because it operationalizes the command as a recommended recovery step.

Static analysis

No suspicious patterns detected.