Unipile

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:40 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a coherent Unipile connector, but its first-time setup tells users or agents to run unverified remote installer scripts directly in a shell.

Review the install step carefully before using this skill. Prefer installing the oo CLI from a verified, versioned source or inspect and verify the installer before running it. The Unipile read actions themselves are coherent, but do not allow automatic execution of the remote installer unless you trust the OOMOL install endpoint and understand the host-level access that installer code would receive.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60
• Finding: Unverified Remote Installation Scripts Are Executed Directly by a Shell## Vulnerability Details **File Location**: `SKILL.md`, lines 60–64 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions download mutable scripts from external URLs and pass their contents directly to `bash` or PowerShell's `Invoke-Expression`. No version pinning, cryptographic signature verification, checksum validation, or manual inspection occurs before execution. Although the scripts are hosted on an OOMOL domain and installation is only suggested when the `oo` command is unavailable, trusting the domain alone does not establish the integrity of the downloaded payload. Compromise of the hosting infrastructure, CDN, DNS resolution, TLS termination, publishing credentials, or installation endpoint could cause arbitrary attacker-controlled commands to execute. Installing the CLI may be necessary for the declared Unipile connector functionality, but executing mutable network content directly exceeds the minimum safe installation behavior. A verified, versioned artifact or trusted package-manager installation would provide the required functionality with substantially lower supply-chain risk. ### Attack Path 1. The `oo` CLI is absent, causing an Agent or user to follow the first-time setup instructions. 2. An attacker compromises or gains control over the installation endpoint or an associated delivery component. 3. The endpoint serves a modified shell or PowerShell script. 4. `curl | bash` or `irm | iex` executes the response immediately, without integrity validation or an opportunity for inspection. 5. The malicious script runs with the privileges of the invoking user and may modify the host, access available data, or install additional components. ### Impact Assessme ...[truncated 569 chars]
• Remediation: ## Remediation Suggestions 1. Remove direct `curl | bash` and `irm | iex` execution from the instructions. 2. Distribute the CLI as a version-pinned package through a trusted platform package manager or as a versioned release artifact. 3. Download the artifact to disk before execution and verify a publisher-provided cryptographic signature or SHA-256 checksum obtained through an independently protected channel. 4. Pin the installer and resulting binary to an explicit version rather than retrieving mutable content from a generic installation URL. 5. Display the exact artifact, version, source, requested privileges, and expected changes, then obtain explicit user approval before installation. 6. Run installation with ordinary user privileges unless elevated access is demonstrably required. 7. Document how users can inspect the installer and verify its signature manually. 8. If an installation script remains necessary, use an authenticated release URL, fail closed on verification errors, and publish reproducible release provenance or equivalent supply-chain attestations.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software via a remote script piped directly into a shell (`curl ... | bash`), which bypasses review of the downloaded code and creates a supply-chain execution risk. If the remote endpoint, transport, or hosting account is compromised, an attacker could achieve arbitrary code execution on the user's machine.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The manifest says to use this skill for "ANY Unipile request," which is a very broad activation condition and does not define clear boundaries or exclusions. This can overlap with many ordinary requests that merely mention Unipile, increasing the risk of unintended invocation.

Static analysis

No suspicious patterns detected.