Whop

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:17 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a coherent Whop reader, but its setup instructions include running an unverified internet installer directly in a shell.

Review this before installing if you are comfortable using OOMOL as the Whop connector. Do not let an agent run the curl|bash or irm|iex installer unattended; prefer a reviewed, pinned, or verified installation path for the oo CLI and confirm what Whop data the connected account can access.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote Installation Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 62–66 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable scripts from `cli.oomol.com` and execute them immediately with Bash or PowerShell. Neither command pins a reviewed release, verifies a cryptographic signature or checksum, nor provides an inspection step before execution. Consequently, the effective code executed is determined by the remote server at installation time rather than by the reviewed Skill package. Compromise of the hosting service, domain, delivery infrastructure, or TLS trust path—or an unsafe future modification of the scripts—could result in arbitrary commands being executed on the user's machine. Installing the required CLI may be necessary for the declared Whop connector functionality, but direct network-to-shell execution exceeds the minimum-risk mechanism necessary to perform that installation. The audit found no evidence establishing that the current remote scripts are malicious; the vulnerability is the unverified remote execution mechanism itself. ### Attack Path 1. A Whop action fails because the `oo` CLI is unavailable. 2. The agent or user follows the documented first-time setup instructions. 3. Bash or PowerShell downloads the current script from `cli.oomol.com`. 4. The downloaded response is passed directly to the corresponding interpreter without integrity verification or review. 5. If the remote content or its delivery path has been compromised, attacker-controlled commands execute with the privileges of the invoking account. 6. Those commands could access user-readable data, alter local files and configuration, steal ...[truncated 814 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `curl | bash` and `irm | iex` installation commands. - Prefer an official operating-system package manager with a pinned package version and trusted repository metadata. - If manual installation is required, download a versioned release artifact separately rather than executing a mutable installation URL. - Publish and verify a cryptographic checksum and, preferably, a signature backed by a documented release key before execution. - Present the downloaded installer for inspection and execute it only after verification. - Require explicit user approval before installing software; do not automatically install the CLI merely because a command failed. - Run installation with ordinary user privileges unless a specific, documented operation requires elevation. - Pin the expected CLI release in the Skill documentation and provide a controlled update procedure.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users to install software via a remote script piped directly into a shell, which executes unreviewed code fetched at runtime. In an agent context this is especially risky because setup guidance may be followed automatically or semi-automatically, turning a documentation snippet into arbitrary code execution if the host, network path, or distribution endpoint is compromised.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest promises a read-oriented skill for 'searching and reading data,' but the body explicitly discusses possible [write] and [destructive] actions. That mismatch can mislead an agent or reviewer about the skill's true capability boundary, increasing the chance that state-changing operations are invoked under a read-only expectation.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Telling the agent to use this skill for 'ANY Whop request' is an overly broad trigger that can capture tasks without sufficient scoping or least-privilege constraints. In context, this is more dangerous because the skill is positioned as a universal interface to an authenticated external account, so broad routing can unnecessarily expand exposure to account data or undisclosed operations.

Intent-Code Divergence

Low

• Confidence: 76% confidence
• Finding: The safety section references [write] and [destructive] actions, but none are actually listed in the available actions. This inconsistency creates ambiguity about what the skill may really expose and weakens operator trust in the documentation, which can cause unsafe assumptions during tool selection and execution.

Static analysis

No suspicious patterns detected.