Tremendous

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:54 AM UTC
• Version: 1.0.2

Overview

The skill is coherent for Tremendous account operations, but it needs Review because its setup recommends executing an unverified remote installer and it can create reward orders.

Before installing, confirm you trust OOMOL and the oo CLI, avoid running pipe-to-shell installer commands unless you have independently verified the installer, and require explicit review of payloads before any create_order action because it can spend or allocate Tremendous rewards.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:67
• Finding: Unverified Remote Installer Download and Immediate Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 67–71 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High The first-time setup instructions download mutable installation scripts from an external server and execute them immediately: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis Both installation commands connect an external network response directly to a command interpreter. The downloaded payload is not pinned to a specific version and is not verified using a hard-coded cryptographic checksum or publisher signature. It is also not saved for inspection before execution. HTTPS provides transport security but does not establish that the mutable installer remains safe following this audit. Compromise of the hosting infrastructure, DNS, CDN, publishing account, TLS endpoint, or installer-generation process could replace the expected installer with attacker-controlled code. Because the external response becomes executable shell or PowerShell input, such a compromise results in arbitrary local code execution. This installation behavior exceeds the minimum privileges required to document or invoke the Tremendous connector. Although installation may be necessary when the CLI is absent, immediate execution of unverified remote content is not necessary; a pinned and independently verified release can be installed instead. ### Attack Path 1. An attacker compromises or otherwise gains control over `https://cli.oomol.com/install.sh`, `https://cli.oomol.com/install.ps1`, or supporting delivery infrastructure. 2. The attacker replaces the legitimate installer response with a malicious shell or PowerShell payload. 3. The `oo` command is unavailable, causing a user or Agent to follow the documented first-time setup instructions. 4. `curl` ...[truncated 985 chars]
• Remediation: ## Remediation Suggestions - Remove both direct execution patterns: `curl | bash` and `irm | iex`. - Distribute the CLI through a trusted package manager or a signed, versioned release artifact from an authoritative repository. - Pin installation instructions to an explicit CLI version rather than a mutable installer endpoint. - Download the artifact to disk without executing it automatically. - Publish a SHA-256 digest through an independently protected release channel and require verification against a hard-coded expected value. - Verify a platform-appropriate publisher signature in addition to the checksum where available. - Abort installation if any checksum, signature, version, or publisher verification fails. - Present the verified artifact and intended installation effects to the user, then require explicit approval before execution. - Avoid requesting administrator or root privileges unless a documented installation step strictly requires them. - Prefer user-scoped installation with narrowly limited filesystem permissions. - Document the files, binaries, and configuration entries created by the installer so users can assess its effects and remove it safely.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill recommends `curl ... | bash`, which executes a remotely fetched script directly in the shell without integrity verification, review, or pinning. If the install endpoint, network path, or hosting infrastructure is compromised, this can lead to arbitrary code execution on the user's machine with the user's privileges.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The instruction to use this skill for ANY Tremendous request is overly broad and encourages routing all Tremendous-related tasks through a shell-capable integration without narrowing by operation type or risk. In practice, this increases the chance that high-impact or sensitive actions are invoked automatically, including write operations, when a safer or more specific workflow should be selected.

Intent-Code Divergence

Low

• Confidence: 93% confidence
• Finding: At L44, `get_order` is tagged `[write]`, which indicates a state-changing action. However, L56-L58 defines untagged `get / list / search` actions as reads and says `[write]` actions change Tremendous state, creating a direct documentation contradiction about the intent and safety classification of `get_order`.

Static analysis

No suspicious patterns detected.