Wappalyzer

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:16 AM UTC
• Version: 1.0.2

Overview

The skill’s Wappalyzer connector use is mostly coherent, but its first-time setup tells users to run unverified remote installer scripts.

Review the first-time setup before installing. Prefer installing the oo CLI from a trusted, versioned, verifiable source instead of running the documented remote shell or PowerShell installer directly. Once oo is installed and connected, the ordinary Wappalyzer connector commands appear scoped to the stated purpose.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58
• Finding: Unverified Remote Shell Script Execution via curl and Bash<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 58 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation command downloads a remotely controlled shell script and immediately pipes it into Bash. The Skill does not pin a release version, verify a cryptographic signature or checksum, save the script for inspection, or validate its contents before execution. Although HTTPS protects the connection in transit, it does not protect against compromise of the hosting server, publishing account, DNS infrastructure, or upstream installation script. The effective executable payload can also change after the Skill package has been reviewed. This installation behavior exceeds the minimum privileges necessary for the declared Wappalyzer lookup functionality. The Skill only requires an existing `oo` CLI installation to invoke the connector; automatically executing mutable remote code is not necessary to perform a Wappalyzer query. ### Attack Path 1. The user or agent attempts to invoke the Skill on a system where `oo` is unavailable. 2. Following the first-time setup instructions, it executes the documented `curl | bash` command. 3. `curl` retrieves the current content of `https://cli.oomol.com/install.sh`. 4. The response is passed directly to Bash without integrity or authenticity verification. 5. If the remote source or delivery infrastructure is compromised, attacker-controlled shell commands execute with the privileges of the invoking account. 6. Those commands can access user-readable information, modify files, install additional software, or retrieve and execute further payloads. ### Impact Assessment A malicious installation script obtains arbitrary command execution under the invoking user's identity. It can read or modify any files accessible to that account, acce ...[truncated 383 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the direct pipe from `curl` to Bash. 2. Prefer installation through a trusted platform package manager or a version-pinned release artifact. 3. If a script must be distributed, download it to a local file without executing it automatically. 4. Publish and verify a cryptographic signature or a pinned SHA-256 checksum before execution. 5. Display the verified script or provide an opportunity for manual inspection. 6. Require explicit user approval before running any installer. 7. Keep installation outside the normal Skill execution path; document it as a manual prerequisite rather than an action for the agent to perform. 8. Run installation with ordinary user privileges and avoid requesting elevated permissions unless a specific component strictly requires them. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote PowerShell Script Execution via Invoke-Expression<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis `irm` is an alias for `Invoke-RestMethod`, while `iex` is an alias for `Invoke-Expression`. The command retrieves content from a remote URL and immediately interprets it as PowerShell code. No version pinning, signature enforcement, checksum verification, local staging, or content review occurs before execution. The remote `install.ps1` file can change independently of the reviewed Skill. A compromise of the remote host or associated publishing infrastructure would therefore provide an execution channel on Windows systems. This behavior is not required for the Skill's core Wappalyzer connector operations. It introduces a broad code-execution capability solely as an installation convenience and consequently exceeds least-privilege expectations for the declared functionality. ### Attack Path 1. The user or agent encounters a missing `oo` command on Windows. 2. It follows the first-time setup documentation and runs the provided PowerShell command. 3. `Invoke-RestMethod` downloads the current `install.ps1` response. 4. The response is piped directly into `Invoke-Expression`. 5. If the upstream script or delivery infrastructure is compromised, attacker-supplied PowerShell executes in the current process and security context. 6. The payload can access local data, modify user configuration, invoke native programs, download additional components, or establish persistence where permissions allow. ### Impact Assessment Successful exploitation provides arbitrary PowerShell execution with the invoking account's privileges. This can expose files, environment variables, browser or application data accessible to the user, and locally available credentials. It may also permit ...[truncated 400 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `irm ... | iex` download-and-execute pipeline. 2. Distribute a version-pinned installer through a trusted Windows package manager or signed release channel. 3. Require Authenticode signature validation for PowerShell installation scripts. 4. If a standalone script remains necessary, download it to disk first and verify its signature and a published cryptographic checksum before execution. 5. Require explicit user approval after verification and before starting the installer. 6. Do not automatically request or assume administrative privileges. 7. Treat CLI installation as a manual prerequisite rather than part of routine Skill execution. 8. Document the expected publisher, release version, hash, and verification commands so users can independently establish artifact integrity. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill recommends installing software via `curl ... | bash`, which executes a remote script fetched at runtime without integrity verification or review. If the remote host, transport, distribution path, or installer is compromised, a user following the skill could execute arbitrary code on their system with the privileges of the current user.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The manifest description says to use this skill for "ANY Wappalyzer request," which is a broad trigger without clear boundaries or exclusion conditions. This can cause unintended invocation whenever Wappalyzer is mentioned, even if the task does not actually require this skill.

Static analysis

No suspicious patterns detected.