CATS

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:56 AM UTC
• Version: 1.0.2

Overview

This CATS skill is mostly coherent for read-only recruiting-data access, but its setup path can execute unverified remote installer scripts and its tool permission is broader than the listed CATS actions need.

Install only if you trust OOMOL and are comfortable with the oo CLI having access through your connected account. Prefer installing oo from a verified official package or reviewed installer rather than letting an agent run curl-to-shell or PowerShell iex commands, and consider using an OOMOL/CATS account limited to the read access you need.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64
• Finding: Unverified Remote Installer Download and Immediate Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 64–68 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable scripts from external URLs and pass them directly to command interpreters. Neither command pins a release version, verifies a cryptographic signature or checksum, nor gives the user or agent an opportunity to inspect the downloaded code before execution. HTTPS authenticates the connection under normal conditions but does not establish that the current script is the same code that was reviewed. Compromise of the hosting account, web infrastructure, DNS, domain registration, or trusted delivery pipeline could therefore change the effective payload after this Skill has been audited. This behavior is not necessary for routine Skill operation because the document explicitly assumes that the `oo` CLI is already installed. Even as a first-time setup fallback, immediate execution is not the minimum-risk installation method. ### Attack Path 1. An attacker compromises the OOMOL installer hosting infrastructure, deployment pipeline, domain, or another component capable of changing the remote installer. 2. The attacker replaces the installer with code that performs unauthorized actions before or alongside installing the CLI. 3. The `oo` command is unavailable, causing the agent or user to follow the documented first-time setup procedure. 4. `curl | bash` or `irm | iex` downloads and immediately interprets the attacker-controlled response. 5. The payload executes with the privileges of the invoking user and can access resources available to that account. ### Impact Assessment Successful exploitation permits arbitrary code execution under t ...[truncated 382 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all instructions that pipe network responses directly into a shell or PowerShell interpreter. 2. Pin installation instructions to an explicit, immutable CLI release version. 3. Download the installer or release artifact to a local file before execution. 4. Publish a SHA-256 or stronger digest through an independently protected release channel and require verification before installation. 5. Prefer signed packages and verify the publisher's cryptographic signature. 6. Use trusted platform package managers where possible, with repository signing and version pinning enabled. 7. Present installation as a manual user-controlled prerequisite rather than allowing the agent to execute an installer automatically. 8. Document the expected artifact URL, version, checksum, signer identity, and verification commands. 9. Run installation without administrator privileges unless a specific installation step demonstrably requires elevation. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5
• Finding: Overbroad Wildcard Permission for the OOMOL CLI<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Excessive tool authorization and failure to enforce least privilege **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: [Bash(oo *)] ``` ### Technical Analysis The Skill's declared functionality is limited to retrieving CATS schemas and executing listed read-only CATS actions. However, the tool policy permits every command whose invocation begins with `oo`, rather than limiting access to the required CATS connector operations. Prompt-level instructions that tell the agent which commands to use are not equivalent to an enforced authorization boundary. If untrusted task content influences command construction, or if the agent makes an error, the wildcard can allow unrelated `oo` subcommands, other connectors, or account-level operations supported by the installed CLI and authenticated OOMOL account. The permission therefore exceeds the minimum authority needed for the declared read-only CATS functionality. ### Attack Path 1. An attacker supplies adversarial content through a user request or data processed during a CATS task. 2. The content induces the agent to construct an `oo` command outside the intended CATS read-action set. 3. The `Bash(oo *)` wildcard accepts the command because it validates only the broad command prefix. 4. The CLI executes the unintended operation using the permissions and connected services available to the authenticated OOMOL account. 5. Data from another service may be accessed, or an unintended account or connector operation may occur, depending on the CLI's available commands and the user's authorization. ### Impact Assessment The maximum practical impact is bounded by the invoking user's OOMOL account, configured connectors, and the capabilities exposed by the installed CLI. Within that boundary, the broad permission could permit access to unrelated connector data or account operations beyond the Skill's stated CA ...[truncated 140 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `Bash(oo *)` with the narrowest tool rules supported by the Skill runtime. 2. Permit only the required command forms: - `oo connector schema "cats" --action <approved-action>` - `oo connector run "cats" --action <approved-action> ...` 3. Enforce an allowlist containing only the documented read actions: - `get_candidate` - `get_company` - `get_job` - `get_site` - `list_candidates` - `list_companies` - `list_jobs` - `search_candidates` - `search_companies` - `search_jobs` 4. Reject alternate connector names, unrecognized actions, shell metacharacters, and additional CLI subcommands through a programmatic wrapper rather than relying solely on natural-language instructions. 5. Use a dedicated OOMOL account or service identity with access only to the required CATS connector and read scopes. 6. Require separate, explicit authorization if write or destructive actions are added in the future. 7. Record and review connector name, action name, execution ID, and authorization outcome in audit logs without logging sensitive record contents. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (`curl ... | bash`). This is dangerous because it executes unverified code from the network with the user's privileges, and a compromised host, CDN, DNS path, or install endpoint could lead to arbitrary code execution on the user's machine.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The description says to use this skill for "ANY CATS request" and whenever a task "involves CATS," which is broad and lacks clear boundaries or exclusions. This can cause unintended invocation for loosely related mentions of CATS rather than specific supported actions.

Static analysis

No suspicious patterns detected.