Viggle

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:55 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent for controlling Viggle through OOMOL, but its setup instructions include unverified remote installer commands that could execute changing code on a user's machine.

Before installing, review the OOMOL CLI installation path yourself and prefer a version-pinned or package-manager install with checksum or signature verification. Use the skill only after the `oo` CLI is already installed, signed in, and connected to Viggle, and approve write or delete actions only after checking the exact target and payload.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:65
• Finding: Unverified Remote Installation Scripts Are Executed Directly by Local Shells<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 65–69 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable content from remote OOMOL endpoints and immediately pass it to a command interpreter. Neither command provides an opportunity to inspect the downloaded script before execution. The instructions also do not pin a script version or verify a cryptographic signature or checksum. HTTPS protects data in transit but does not ensure that the delivered script remains identical to the version reviewed during this audit. Compromise of the hosting server, DNS or certificate infrastructure, deployment pipeline, or authorized publishing account could cause arbitrary attacker-controlled commands to be delivered to users. Although installing the `oo` CLI supports the skill's declared functionality, direct pipe-to-shell execution exceeds the minimum privilege and trust necessary for installation. A safer installation process can download a versioned artifact, authenticate it, and obtain explicit user approval before execution. ### Attack Path 1. The `oo` command is unavailable, or a user receives a command-not-found error. 2. The user or agent follows the documented first-time setup instructions. 3. `curl` or PowerShell downloads the current response from the remote installation endpoint. 4. The response is passed directly to Bash or PowerShell without integrity verification or inspection. 5. If the endpoint or its software supply chain has been compromised, the attacker's script executes with the privileges of the invoking user. 6. The payload can access resources available to that user and may download additional components, steal accessible informa ...[truncated 906 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | bash` and `irm | iex` installation commands. 2. Direct users to an official, version-pinned release artifact or trusted platform package manager. 3. Download the installer to a local file before execution so it can be inspected: ```bash curl -fL -o install.sh "https://example.invalid/releases/v1.0.2/install.sh" ``` 4. Publish an expected SHA-256 checksum through a separately protected release channel and verify it before execution: ```bash echo "<expected-sha256> install.sh" | sha256sum --check - ``` 5. Prefer cryptographic signature verification using a documented signing key rather than relying only on checksums. 6. Require explicit user approval after download and verification and before running the installer. 7. Ensure the installer runs without administrator privileges unless a specific installation operation demonstrably requires elevation. 8. Pin the CLI version compatible with this skill instead of retrieving an unversioned, mutable installer. 9. Document the files, network endpoints, and configuration changes performed during installation. 10. Prevent the agent from automatically performing installation; installation should remain a deliberate user-controlled setup action. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 95% confidence
• Finding: The skill instructs the agent to install software by piping a remotely fetched script directly into `bash`, which is a classic unsafe pattern because the downloaded content is executed without prior verification, pinning, or integrity checking. In this skill context, the risk is elevated because the installation step is embedded as fallback guidance inside an automation skill, making it more likely an agent could execute it non-interactively if the CLI is missing.

Static analysis

No suspicious patterns detected.