Zenkit

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:55 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for Zenkit access, but its first-time setup tells users to execute remote installer scripts directly in a shell.

Review the installer path before installing. Prefer installing the oo CLI from official, verifiable release or package-manager instructions, and confirm exactly what Zenkit data will be changed before allowing create, update, or delete actions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote Shell Script Execution via Bash<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation command pipes a remotely retrieved script directly into Bash. The remote payload is mutable and is executed without local inspection, version pinning, cryptographic signature verification, or checksum validation. Although `cli.oomol.com` is consistent with the declared OOMOL service, the audited project does not establish the installer’s contents or integrity. Consequently, control of the remote endpoint, DNS resolution, hosting infrastructure, or trusted delivery path provides effective arbitrary code execution with the privileges of the user running the command. Installing the required CLI is related to the Skill’s functionality, but immediate execution of unverified remote content exceeds the minimum privilege and trust necessary for installation. ### Attack Path 1. A user or Agent attempts to use the Skill on a system where the `oo` CLI is unavailable. 2. The documented first-time setup procedure is followed. 3. `curl` retrieves the current contents of `https://cli.oomol.com/install.sh`. 4. The response is passed directly to Bash without being saved, reviewed, or authenticated. 5. If the remote source or delivery path has been compromised, attacker-controlled shell commands execute with the invoking user’s privileges. 6. Those commands can modify files, steal accessible credentials, install persistence, or transmit local data. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking account. The accessible scope may include that user’s files, shell configuration, environment variables, authentication material, connected-service data, and any resources available through the user’s existing permissions. If ...[truncated 244 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not pipe network responses directly into a shell. - Download a version-pinned installer or release artifact to a local file without executing it. - Publish and verify a cryptographic signature from a separately trusted key. At minimum, verify a version-specific cryptographic checksum obtained through an independent trusted channel. - Permit inspection of the downloaded artifact before execution. - Prefer an established, signed package manager or a pinned release from a verifiable official repository. - Run installation with ordinary user privileges unless a narrowly defined step explicitly requires elevation. - Document the files, permissions, and network destinations used by the installer. - Fail closed if integrity verification does not succeed. A safer workflow is: download a specific release, verify its signature or checksum, inspect it where appropriate, and execute the verified local artifact as a separate step. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66
• Finding: Unverified Remote PowerShell Script Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 66 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The PowerShell command retrieves a mutable script with `Invoke-RestMethod` (`irm`) and immediately evaluates it with `Invoke-Expression` (`iex`). No fixed release, checksum, digital-signature check, or opportunity for review is provided. `Invoke-Expression` treats the network response as executable PowerShell code. Therefore, compromise of the remote endpoint or trusted delivery infrastructure can directly result in arbitrary command execution. The matching service hostname does not independently prove the integrity of the payload returned at execution time. Installing the CLI supports the declared functionality, but direct evaluation of unauthenticated remote script content creates substantially more trust and execution exposure than is necessary. ### Attack Path 1. A user or Agent attempts to use the Skill on Windows without the `oo` CLI installed. 2. The first-time setup instructions are followed. 3. PowerShell retrieves the current response from `https://cli.oomol.com/install.ps1`. 4. The response is passed directly to `Invoke-Expression`. 5. A compromised or malicious response executes as PowerShell code with the current process’s privileges. 6. The payload can access user-readable data, alter the user environment, capture credentials, create persistence, or perform network exfiltration. ### Impact Assessment Exploitation grants arbitrary PowerShell execution as the invoking user. This can expose files, environment variables, browser or CLI authentication material, shell profiles, and other resources available to that account. Execution from an elevated PowerShell session could permit system-wide modification and persistence. The project contains only ...[truncated 149 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `irm ... | iex` installation pattern. - Download a specific, immutable release to disk before execution. - Require a valid Authenticode signature from a trusted publisher or verify a version-specific cryptographic checksum through an independent trusted channel. - Reject unsigned, invalidly signed, or checksum-mismatched artifacts. - Avoid `Invoke-Expression`; invoke only the verified local installer using an explicit command. - Use a signed package from a trusted package manager where possible. - Install with least privilege and request elevation only for documented operations that require it. - Document expected installer behavior, filesystem changes, permissions, and network access. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software by piping a remote script directly into a shell (`curl ... | bash`), which executes unverified code from the network without integrity checking. If the install endpoint, transport, or upstream distribution is compromised, this can lead to arbitrary code execution on the host running the command.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use this skill for "ANY Zenkit request" and "Whenever a task involves Zenkit," which is extremely broad and lacks scope boundaries or exclusion conditions. This can overlap with many ordinary references to Zenkit and does not provide negative examples or constraints on when the skill should not activate.

Static analysis

No suspicious patterns detected.