Twenty CRM

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:10 AM UTC
• Version: 1.0.2

Overview

This is a coherent Twenty CRM connector, but its setup instructions include unsafe remote installer commands that should be reviewed before use.

Install only if you are comfortable using OOMOL as an intermediary for Twenty CRM actions. Before installing the oo CLI, prefer an official versioned release or package-manager path with integrity verification instead of running the pipe-to-shell commands shown in the skill. Confirm all create, update, and delete CRM operations before allowing them to run.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60

Finding

Unverified Remote Installation Scripts Executed Directly by System Shells

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60–64
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions download mutable content from an external server and pass it directly to a command interpreter. The Unix command pipes the HTTP response into Bash, while the Windows command evaluates the response through PowerShell's Invoke-Expression.

Neither installation path pins a specific release nor verifies a cryptographic signature or checksum before execution. HTTPS protects data in transit but does not establish that the returned script is the same content that was reviewed. Compromise of the vendor server, publishing account, distribution infrastructure, or another relevant control-plane component could therefore turn the documented installation command into an arbitrary-code execution channel.

Installing a required CLI may support the Skill's declared functionality, but immediate execution of unverified remote content is not the minimum privilege or safest mechanism necessary to perform that installation.

Attack Path

1. The oo CLI is unavailable, causing the first-time setup instructions to become applicable.
2. An attacker compromises or gains control over the installation endpoint or its deployment process.
3. The attacker modifies install.sh or install.ps1 to contain malicious commands.
4. The user or Agent runs the documented installation command.
5. The remote response is passed directly to Bash or PowerShell without review or integrity validation.
6. The malicious commands execute with the permissions of the invoking account and may retrieve additional payloads, access locally available data, or modify the system.

Imp

...[truncated 690 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both pipe-to-shell installation commands from the Skill instructions.
2. Direct users to a trusted package manager or an official, versioned release artifact.
3. Pin the CLI to an explicit release version rather than retrieving a mutable installation script.
4. Download the artifact without executing it, then verify a vendor signature or a SHA-256 checksum obtained through a separately protected channel.
5. Execute the installer only after successful integrity verification and explicit user approval.
6. Avoid elevated privileges unless a documented installation step strictly requires them.
7. Publish reproducible release metadata and retain prior signed versions so users can audit and roll back installations.
8. If a bootstrap script remains available, present it for inspection as a separate download and do not automatically evaluate its network response.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell, which is a classic supply-chain and arbitrary code execution risk. If the remote server, CDN, DNS, TLS termination, or distribution pipeline is compromised, the agent could execute attacker-controlled code on the host without review.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use this skill for "ANY Twenty CRM request" and "Whenever a task involves Twenty CRM," which is extremely broad and lacks boundary conditions or exclusion examples. This can cause unintended invocation for casual mentions, planning discussions, or tasks where direct API use might still be appropriate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.