Weixin Bot

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:17 AM UTC
• Version: 1.0.0

Overview

This Weixin Bot connector is mostly coherent, but it includes first-time setup commands that run unverified internet scripts as local code.

Review the setup instructions before installing. The normal oo connector commands are scoped and the skill asks for confirmation before write actions, but do not run the documented curl|bash or irm|iex installer unless you independently trust the source and are comfortable executing remote code on your machine. Prefer a pinned, signed, or checksum-verified installer if available.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59
• Finding: Remote installation script executed directly through Bash## Vulnerability Details **File Location**: `SKILL.md`, line 59 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes an HTTPS response directly into Bash. The downloaded content is neither version-pinned nor verified using a cryptographic signature or published checksum, and the user has no opportunity to inspect it before execution. Although the instruction is limited to first-time setup when the `oo` command is unavailable, installing the CLI does not require executing mutable network content without verification. HTTPS protects data in transit but does not protect against compromise of the hosting server, distribution infrastructure, DNS or certificate trust chain, or the publisher account. It also cannot ensure that the script remains unchanged after this Skill has been reviewed. The effective executable payload is therefore controlled by the remote endpoint at execution time rather than by the audited Skill package. ### Attack Path 1. The `oo` CLI is absent, causing the documented first-time setup condition to apply. 2. The user or agent runs the documented `curl` command. 3. `curl` retrieves the current response from `https://cli.oomol.com/install.sh`. 4. The response is passed directly to Bash without integrity verification or inspection. 5. If the endpoint or its delivery chain has been compromised, attacker-controlled shell commands execute immediately. 6. Those commands can access resources available to the invoking account and can download additional payloads, modify local files, or establish persistence. ### Impact Assessment A malicious remote response would obtain arbitrary command execution with the privileges of the user running the installation command. It could read or alter files accessible to that account, access locally availab ...[truncated 295 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl | bash` installation pattern. - Direct users to an official package manager or a version-pinned release artifact from a verified publisher. - If a script must be used, separate downloading from execution. - Publish a cryptographic checksum or signature through an independently protected channel and require verification before execution. - Allow the downloaded script to be inspected before it is run. - Require explicit user approval before installing software. - Run installation with the least-privileged account possible and avoid requesting administrative privileges unless strictly necessary. - Pin the installer or CLI to an audited version rather than retrieving mutable content from an unversioned URL. A safer workflow is: download a specific release artifact, verify its publisher signature and expected SHA-256 digest, inspect it, and only then execute it as a non-privileged user.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63
• Finding: Remote installation script executed directly through PowerShell## Vulnerability Details **File Location**: `SKILL.md`, line 63 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis This instruction retrieves a PowerShell script using `Invoke-RestMethod` (`irm`) and immediately evaluates the returned text using `Invoke-Expression` (`iex`). No version pinning, checksum validation, signature verification, or manual review occurs before execution. `Invoke-Expression` treats the network response as trusted PowerShell code. Consequently, any party able to compromise the remote endpoint or delivery chain can change the effective payload after the Skill has been audited. The instruction is conditional on the CLI being unavailable, but immediate evaluation of mutable remote content still exceeds the minimum privilege and trust necessary to install a command-line tool. ### Attack Path 1. The `oo` CLI is unavailable on a Windows system. 2. The user or agent follows the documented first-time setup instruction. 3. `Invoke-RestMethod` retrieves the current contents of `https://cli.oomol.com/install.ps1`. 4. The pipeline passes the unverified response to `Invoke-Expression`. 5. A compromised endpoint or delivery path supplies attacker-controlled PowerShell. 6. PowerShell executes the response with the invoking process's privileges, allowing further payload retrieval, local modification, credential access, or persistence attempts. ### Impact Assessment Successful exploitation provides arbitrary PowerShell execution under the invoking user's security context. An attacker could access files and credentials available to that account, modify user-level configuration, replace or spoof the installed CLI, download additional malware, or create user-level persistence. If PowerShell is running with administrative privileges, the same path could lead to system-wi ...[truncated 84 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` pattern and avoid `Invoke-Expression` for remotely obtained content. - Use a version-pinned, Authenticode-signed installer or package from a verified official distribution channel. - Download the installer to disk without executing it automatically. - Validate both the publisher signature and a published cryptographic digest before execution. - Require explicit user approval after displaying the artifact source, version, expected effect, and required privileges. - Execute installation without administrative privileges unless a documented component strictly requires elevation. - Prefer a trusted Windows package manager with publisher verification and a pinned package version. - Ensure installation artifacts cannot silently replace trusted tools with unverified binaries.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs the agent to install software via a remote script piped directly into a shell (`curl ... | bash`), which is a classic supply-chain and remote code execution risk. Because the content is in a fallback setup path for missing tooling, an agent may execute it on the host without verifying integrity, origin, or user approval.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The manifest description says to use this skill for "ANY Weixin Bot request" and "Whenever a task involves Weixin Bot," which is a broad activation condition without scope limits or negative examples. This could cause unintended invocation for loosely related conversations mentioning Weixin Bot rather than clearly defined operational tasks.

Static analysis

No suspicious patterns detected.