Yelp

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:09 AM UTC
• Version: 1.0.3

Overview

The Yelp connector behavior is mostly coherent and read-only, but its setup instructions tell users to execute unverified remote installer scripts directly.

Review the setup commands before installing. Prefer installing the oo CLI from a verified release or package-manager path with checksums or signatures, and avoid running the remote installer pipelines directly unless you trust OOMOL's installer channel and are comfortable granting it your local user permissions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:57

Finding

Unverified Remote Installer Downloaded and Executed Directly

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57–61
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

Vulnerable Code

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions download mutable scripts from cli.oomol.com and immediately execute them using Bash or PowerShell. Neither command pins a specific installer version nor verifies a cryptographic signature or expected checksum before execution.

HTTPS protects the connection in transit, but it does not protect users if the hosting infrastructure, publishing account, DNS configuration, or installer itself is compromised. It also does not ensure that the script executed in the future is the same script that was available when this Skill was audited. The remote server therefore controls the effective code executed by these instructions.

Installing the CLI may be necessary when oo is unavailable, but passing unreviewed network content directly to an interpreter grants that content all permissions held by the invoking process. This exceeds the minimum safe installation mechanism.

Attack Path

1. The oo command is unavailable and an agent or user follows the documented first-time setup procedure.
2. An attacker compromises or otherwise gains control over the remote installer content served from cli.oomol.com.
3. curl or Invoke-RestMethod retrieves the attacker-controlled script.
4. The shell pipeline passes the response directly to Bash or Invoke-Expression without integrity verification or inspection.
5. The malicious script executes with the permissions of the user or agent that launched the command.
6. The script can perform any operation available under those permissions, including modifying files, accessing ...[truncated 712 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace direct pipe-to-shell installation with a version-pinned package or release artifact obtained from an authenticated release channel.
2. Publish expected SHA-256 checksums or cryptographic signatures through a separately protected channel and require verification before execution.
3. Download the installer to a local file rather than sending its response directly to an interpreter.
4. Allow the user to inspect the downloaded file and require explicit approval before executing it.
5. Execute installation with the least privileges necessary and avoid requesting administrator or root access unless a documented installation step strictly requires it.
6. Prefer an operating-system package manager with package signing and version locking where supported.
7. Document the exact installer version tested with this Skill and fail safely if integrity verification does not succeed.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into the shell (curl ... | bash). That pattern enables arbitrary code execution if the remote server, distribution path, or transport is compromised, and the agent would execute unreviewed code on the host.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use this skill for "ANY Yelp request" and "Whenever a task involves Yelp," which is a very broad activation condition. It does not define narrower trigger boundaries or exclusions, so ordinary mentions of Yelp could cause unintended invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.