Wire2Air

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:30 AM UTC
• Version: 1.0.0

Overview

The skill is coherently aimed at Wire2Air, but its setup instructions tell users or agents to run unverified remote installer scripts.

Review the setup path before installing. Use the skill only if you are comfortable with OOMOL's oo CLI and Wire2Air connector, confirm any SMS-sending payload before it runs, and avoid executing the remote installer commands unless you have independently verified the installer source and trust the publisher.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:56
• Finding: Unverified Remote Shell Script Download and Execution on macOS and Linux## Vulnerability Details **File Location**: `SKILL.md`, line 56 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes a remotely downloaded script directly into `bash`. The effective code is retrieved at execution time and is therefore not fixed to the content reviewed with this Skill. No release version, cryptographic checksum, publisher signature, or other integrity verification is specified before execution. HTTPS protects the script in transit under normal conditions, but it does not mitigate compromise of the distribution server, publishing account, DNS or certificate infrastructure, or upstream deployment pipeline. If the remote script changes or is compromised, arbitrary commands can execute with the privileges of the user running the installation command. Installing the declared `oo` CLI can be necessary for the Skill, but immediate execution of mutable remote content exceeds the minimum safe mechanism needed to install that dependency. ### Attack Path 1. An attempted `oo` command fails because the CLI is unavailable. 2. The user or agent follows the first-time setup instructions in `SKILL.md`. 3. `curl` retrieves the current contents of `https://cli.oomol.com/install.sh`. 4. The response is passed directly to `bash` without being saved, reviewed, pinned, or cryptographically verified. 5. If the endpoint or its software supply chain is compromised, attacker-controlled shell commands execute immediately. 6. Those commands can access or modify resources available to the invoking user. ### Impact Assessment Successful exploitation provides arbitrary code execution under the invoking user's account. The payload could read accessible files and credentials, modify the user's environment, install additional software, tamper ...[truncated 399 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl | bash` installation pattern. - Direct users to a version-pinned release artifact or a trusted operating-system package manager. - Download the installer as a separate step rather than executing the network response immediately. - Publish and require verification of a pinned SHA-256 digest and, preferably, a cryptographic signature tied to a documented publisher key. - Allow the downloaded script to be inspected before execution. - Require explicit user approval before installing software. - Run installation with ordinary user privileges unless a narrowly defined operation genuinely requires elevation. - Document the exact version, expected files, installation destination, and required permissions.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60
• Finding: Unverified Remote PowerShell Script Download and Execution on Windows## Vulnerability Details **File Location**: `SKILL.md`, line 60 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis `irm` retrieves mutable content from an external URL and passes it directly to `iex` (`Invoke-Expression`). This causes the response to be interpreted as PowerShell code without version pinning, local review, signature validation, or checksum verification. Although the URL uses HTTPS and belongs to the declared CLI provider, transport encryption does not establish the long-term integrity of the script. Compromise of the hosting service, publishing credentials, deployment pipeline, DNS, or certificate infrastructure could replace the installer with attacker-controlled PowerShell. Installing the declared CLI may be necessary for first-time setup, but directly evaluating an unverified network response grants the remote endpoint more execution authority than is minimally necessary. ### Attack Path 1. An attempted `oo` command fails because the CLI is not installed. 2. The user or agent follows the Windows first-time setup instruction. 3. `Invoke-RestMethod` downloads the current response from `https://cli.oomol.com/install.ps1`. 4. The response is piped directly into `Invoke-Expression`. 5. A compromised endpoint or software supply chain supplies attacker-controlled PowerShell. 6. PowerShell executes the payload with the current process token and all permissions available to the invoking user. ### Impact Assessment Exploitation enables arbitrary PowerShell execution with the user's privileges. An attacker could read accessible documents and credentials, alter the user profile, modify PowerShell configuration, download additional payloads, tamper with local tools, or create persistence. Running the command from an elevated PowerShell sess ...[truncated 230 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` installation instruction. - Use a version-pinned package from a trusted package manager or a signed release artifact. - Download the PowerShell installer to a local file as a separate operation. - Verify an Authenticode signature from an expected publisher and a pinned cryptographic digest before execution. - Require explicit user approval after verification and before running the installer. - Execute with standard-user permissions unless elevation is demonstrably necessary. - Document the expected version, signer identity, digest, installation destination, and permission requirements. - Prefer an installation mechanism that fails closed when signature or integrity validation is unsuccessful.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs the agent to install software via a remote script piped directly into a shell, which is a classic supply-chain risk because the fetched content is executed without integrity verification or user review. In this context, the danger is increased because the instruction appears in operational fallback guidance, making it more likely to be followed automatically during error handling.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The instruction to use this skill for ANY Wire2Air request is overly broad and can cause the agent to invoke the skill even for ambiguous mentions, bypassing normal tool-selection caution and increasing the chance of unintended reads or writes. In this skill context, that matters because the skill supports state-changing actions such as sending messages, so over-triggering can lead to privacy or operational mistakes.

Static analysis

No suspicious patterns detected.