Jam

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:26 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a coherent Jam connector, but its setup instructions include unverified remote installer commands that can execute code on the user's machine.

Review the setup path before installing. The Jam connector behavior itself is narrowly described, but avoid running the provided remote installer pipelines as-is; prefer an official, versioned installation method with signature or checksum verification, and only connect the Jam account you intend the tool to access.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:55
• Finding: Unverified Remote Shell Script Execution## Vulnerability Details **File Location**: `SKILL.md`, line 55 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical **Complete Code Snippet**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The first-time setup instructions pipe a remotely downloaded, mutable script directly into Bash. The script is not pinned to a reviewed version, downloaded for inspection, or checked against a cryptographic signature or trusted checksum before execution. HTTPS protects the connection in transit but does not establish that the current script is identical to the version reviewed with this Skill. Compromise of the vendor's web server, publishing account, CDN, DNS/TLS infrastructure, or installer release process could replace the response with attacker-controlled shell commands. Installing the CLI is ancillary setup rather than part of the Skill's declared Jam data-reading operation. Direct execution of an unverified installer therefore exceeds the minimum safe behavior necessary to guide installation. ### Attack Path 1. The `oo` CLI is absent, and an action fails with `oo: command not found`. 2. The Agent or user follows the fallback installation instruction. 3. An attacker compromises or gains control of the installer response at `https://cli.oomol.com/install.sh`. 4. `curl` retrieves the attacker-controlled response. 5. The shell pipeline passes that response directly to Bash without review or integrity verification. 6. Bash executes the payload with the invoking user's privileges. ### Impact Assessment Successful exploitation permits arbitrary command execution as the user running the command. The payload could access files and environment variables available to that user, steal credentials or session material, modify user-owned applications and shell configuration, install persistence within writable locations, or download ...[truncated 217 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl | bash` installation pattern. - Prefer an official package manager or a version-pinned release artifact from a verified publisher. - Download the installer to a local file without executing it. - Verify a vendor-published cryptographic signature and a checksum obtained through an independently authenticated channel. - Display the pinned version, source, expected digest, and requested privileges before installation. - Require explicit user approval before executing any installer. - Run installation with ordinary user privileges where supported, and do not request administrative privileges unless they are strictly necessary. - Provide commands that fail closed if signature or checksum verification fails.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59
• Finding: Unverified Remote PowerShell Script Execution## Vulnerability Details **File Location**: `SKILL.md`, line 59 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical **Complete Code Snippet**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows setup instruction uses `Invoke-RestMethod` (`irm`) to retrieve mutable PowerShell source and passes the result directly to `Invoke-Expression` (`iex`). This executes the server's current response without artifact pinning, local inspection, Authenticode validation, or checksum verification. Because the effective payload remains under remote control after the Skill is reviewed, a compromised installer endpoint or publishing pipeline can turn the documented setup command into an arbitrary code-execution channel. The use of HTTPS does not mitigate a compromise of the trusted endpoint itself. Installing the CLI is only a fallback prerequisite for the declared connector operation. Immediate interpretation of an unverified remote response is not the least-privileged or minimum-risk mechanism necessary to provide that setup. ### Attack Path 1. The `oo` CLI is unavailable on a Windows host. 2. The Agent or user follows the documented PowerShell setup instruction. 3. An attacker compromises the installer host, publishing credentials, delivery infrastructure, or installer content. 4. `Invoke-RestMethod` downloads the modified PowerShell source. 5. The pipeline sends the response directly to `Invoke-Expression`. 6. PowerShell executes the attacker-controlled commands in the invoking user's security context. ### Impact Assessment Successful exploitation provides arbitrary PowerShell execution with the current user's permissions. An attacker could read accessible files, collect environment variables and user credentials, alter PowerShell profiles or other user-writable startup locations, modify applications and conf ...[truncated 236 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` pattern and avoid `Invoke-Expression` for downloaded content. - Distribute a version-pinned installer through a verified official release channel or trusted Windows package manager. - Download the artifact separately and validate its Authenticode signature, signer identity, and published cryptographic digest before execution. - Stop installation if the signature is absent, invalid, expired without a valid timestamp, or issued to an unexpected publisher. - Present the artifact version, source, verified publisher, digest, and requested privileges to the user. - Obtain explicit approval before installation and avoid elevation unless the selected installation mode strictly requires it. - Retain a documented, auditable installation command whose effective content cannot change silently after review.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users/agents to install software via `curl ... | bash`, which executes a remotely fetched script without prior verification. If the remote host, transport, installer, or distribution path is compromised, this can lead to arbitrary code execution on the local system running the skill, and the risk is amplified because the command is presented as a recovery path inside the skill itself.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The description says to use this skill for "ANY Jam request," which is a very broad activation condition and does not define clear boundaries for when the skill should or should not be invoked. This can cause unintended invocation for loosely related mentions of Jam, especially since no exclusions or negative examples are provided.

Static analysis

No suspicious patterns detected.