Security audit

ZeroBounce

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for using ZeroBounce through OOMOL, but its first-time setup tells users to execute unverified remote installer scripts directly in a shell.

Review the oo CLI installation method before installing. Prefer a signed or checksum-verified installer from the vendor rather than running the pipe-to-shell commands as written, and avoid sending sensitive or bulk email data through the connector unless OOMOL's data handling terms meet your needs.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:60
Finding: Unverified Remote Shell Script Execution on macOS and Linux
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:64
Finding: Unverified Remote PowerShell Script Execution on Windows
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:25
Finding: ZeroBounce Request Data Is Mandatorily Routed Through an Additional Third Party
Content: View full analysis
" ``` ```bash oo connector run "zerobounce" --action "" --data '' --json ``` ```markdown - `--data` takes a JSON object string or `@path/to/file.json`; omit it to send `{}`. - The response is `{ "data": ..., "meta": { "executionId": "..." } }`; the execution id lives under `meta.executionId`. ``` ### Technical Analysis The Skill requires all ZeroBounce operations to use OOMOL's connector rather than allowing the Agent to call ZeroBounce directly. The `--data` argument sends action payloads through OOMOL's infrastructure. For the documented `validate_email` action, those payloads can include email addresses, which may constitute personal or customer data. Network transmission is inherent to a remote email-validation service, and the Skill explicitly discloses that OOMOL is used. However, routing the payload through an additional intermediary is not technically necessary for ZeroBounce itself to process a direct API request. The unconditional instruction to use this route for every ZeroBounce request can therefore increase data exposure beyond the minimum destination needed for the underlying task. The reviewed file does not document ...[truncated 1347 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The skill instructs users to install software by piping a remote script directly into a shell (curl ... | bash), which executes unverified code from the network with the user's privileges. If the install endpoint, transport, hosting, or upstream distribution is compromised, this can lead to arbitrary code execution and full environment compromise.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

bash
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux

powershell

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown skill description defines invocation scope in very broad terms without examples or exclusions. The phrasing could overlap with many incidental mentions of ZeroBounce and does not clearly distinguish when the skill should or should not activate.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.