WHO Global Health Observatory

• Outcome: Review
• Latest audit: Nov 3, 2026 · 11:50 AM UTC
• Version: 1.0.4

Overview

The WHO data features fit the stated purpose, but setup can execute unverified downloaded code without a clear approval step.

Review the setup before allowing installation. Require approval for local changes and use a reviewed, version-pinned CLI distribution with verified integrity instead of directly executing downloaded scripts. Check which additional agent skills the CLI installs. WHO queries use OOMOL and may incur charges. No malicious intent is established; the material concern is the installation authority and its insufficient user control.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

When the CLI is missing, the skill expands a read-only data request into software installation by executing a remotely fetched script without requiring user approval. Installing a connector dependency is relevant to the workflow, and the fallback is conditional, but neither fact authorizes arbitrary code execution on the user's machine. This overlaps with the remote-installation findings rather than establishing a separate malicious behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The supplied chunk performs only a CLI login operation; it contains no WHO-specific search or data-reading behavior. Authentication can be a supporting implementation detail, but nothing in this chunk establishes that this login supports WHO access. The command's authentication destination and handling of credentials cannot be determined from the supplied code.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The command pipes an HTTPS response directly into Bash without pinning or verifying the script's contents. HTTPS protects transport but does not prevent a compromised publisher or distribution endpoint from delivering code that steals accessible secrets or modifies the system. This is the concrete Unix installation instance of the same setup risk identified above, not evidence that the domain is inherently malicious.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Setup instructions execute remotely downloaded scripts without warning about the system-integrity risk.

Medium

• Category: Output Handling
• Confidence: 98% confidence

Finding

Both setup examples immediately execute mutable remote content, using a shell pipeline on Unix-like systems and Invoke-Expression on Windows. A compromised distribution endpoint or malicious installer could execute with the invoking user's privileges and access local files or credentials. The missing-command condition limits when this happens, but the setup provides neither integrity verification nor an explicit approval boundary.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.

- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.

## Resources