VerifiedEmail

• Outcome: Review
• Latest audit: Sep 15, 2026 · 6:18 AM UTC
• Version: 1.0.3

Overview

The skill appears to serve a real VerifiedEmail workflow, but its setup instructions tell users to run unverified remote installer scripts, so it needs review before installation.

Review the setup path before installing. Prefer official, version-pinned OOMOL CLI installation instructions with checksum or signature verification instead of piping a network response directly into a shell. Connect only the intended VerifiedEmail account and confirm email verification payloads because they may expose addresses to the service and consume credits.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60
• Finding: Unverified Remote Installer Executed Directly by a Shell## Vulnerability Details **File Location**: `SKILL.md:60` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The setup instructions pipe a remotely retrieved installation script directly into `bash`. The script is not pinned to an immutable release, downloaded for inspection, or verified using a cryptographic checksum or signature before execution. Although HTTPS protects the connection in transit and the URL uses OOMOL's service domain, it does not guarantee that the remotely hosted script will remain unchanged after this Skill has been audited. A compromise of the hosting service, deployment process, DNS or certificate infrastructure, or the installer itself could turn this command into arbitrary code execution. Installing the CLI may support the Skill's declared VerifiedEmail functionality, but immediate execution of mutable network content exceeds the minimum mechanism needed to install that dependency safely. ### Attack Path 1. The `oo` CLI is absent, causing an `oo: command not found` error. 2. The Agent or user follows the Skill's first-time setup instructions. 3. `curl` retrieves the current contents of `https://cli.oomol.com/install.sh`. 4. The pipe sends the response directly to `bash` without integrity verification or review. 5. If the remote installer or its delivery infrastructure has been compromised, attacker-controlled commands execute with the privileges of the invoking account. ### Impact Assessment A malicious installer could obtain arbitrary command execution under the Agent or user's operating-system account. Depending on that account's privileges and the installer's use of privilege elevation, the payload could access local files and environment variables, steal credentials, modify tools or configuration, install additional software, esta ...[truncated 200 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl | bash` installation pattern. - Pin installation instructions to a specific, immutable CLI release. - Download the installer or binary as a separate step without executing it automatically. - Publish and require verification of a cryptographic checksum or, preferably, a signed release artifact. - Execute the verified artifact only after validation succeeds. - Prefer a reputable platform package manager with explicit version pinning where available. - Document whether administrative privileges are required and install with the least privileged account possible. - Fail closed if signature or checksum verification cannot be completed.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64
• Finding: Unverified Remote PowerShell Installer Executed Directly## Vulnerability Details **File Location**: `SKILL.md:64` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows setup instruction retrieves a mutable remote PowerShell script with `Invoke-RestMethod` (`irm`) and immediately evaluates it with `Invoke-Expression` (`iex`). There is no pinned release, local review step, cryptographic checksum validation, or signature verification. The effective code is controlled by the content served from the external URL at execution time and can therefore differ from the content available when the Skill was reviewed. HTTPS alone does not establish artifact immutability or protect users if the hosting or release infrastructure is compromised. This immediate evaluation behavior is not required to provide VerifiedEmail access. The CLI can instead be obtained as a fixed, independently verified release artifact. ### Attack Path 1. The `oo` CLI is unavailable on a Windows host. 2. The Agent or user follows the documented first-time setup procedure. 3. `irm` downloads the current script from `https://cli.oomol.com/install.ps1`. 4. The pipeline passes the response directly to `iex`. 5. PowerShell evaluates the response as code without integrity validation. 6. A compromised installer or delivery service can consequently execute attacker-controlled PowerShell commands with the invoking user's privileges. ### Impact Assessment Successful exploitation provides arbitrary PowerShell execution in the security context of the invoking account. A payload could read accessible files and environment variables, extract credentials, alter user configuration, replace local tools, download additional payloads, or create persistence. If the process is elevated or prompts for and receives administrative access, the impact could ext ...[truncated 28 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` pattern and never evaluate a network response directly. - Distribute a version-pinned installer or package through an authenticated release channel. - Download the artifact to disk first and verify its Authenticode signature and a published cryptographic hash. - Stop installation if the expected publisher, signature, version, or hash does not match. - Prefer a trusted Windows package manager with an explicit package identity and pinned version. - Run installation without administrative privileges unless a documented component strictly requires elevation. - Provide separate, reviewable download, verification, and execution commands.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs the agent to install software by piping a remote script directly into a shell (`curl ... | bash`). This is dangerous because it executes unverified code fetched at runtime from an external server, enabling supply-chain compromise or remote code execution if the host, network path, or distribution endpoint is compromised.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The phrase "Use this skill for ANY VerifiedEmail request" is broad and lacks clear boundaries or exclusion conditions. In a markdown skill file, this can cause unintended invocation for loosely related mentions of VerifiedEmail rather than a well-scoped set of triggers.

Static analysis

No suspicious patterns detected.