Recruiterflow

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:05 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent for read-only Recruiterflow access, but its setup instructions include unverified remote installer commands that could run arbitrary code.

Install only if you are comfortable using OOMOL as a Recruiterflow connector and you already have or can install the oo CLI through a safer verified method. Avoid running the documented curl-to-bash or PowerShell Invoke-Expression installer unless you first verify the source and integrity of the installer.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60

Finding

Unverified Remote Installer Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60–64
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions pipe remotely retrieved content directly into a command interpreter. The Bash command sends the current response from cli.oomol.com directly to bash, while the PowerShell command passes it to Invoke-Expression. Neither instruction pins an installer version, verifies a cryptographic signature or checksum, nor gives the user an opportunity to inspect the downloaded script before execution.

Consequently, the effective code executed by these commands can change after the Skill has been reviewed. Compromise of the hosting infrastructure, domain, DNS path, deployment pipeline, or installer itself could turn these instructions into an arbitrary-code-execution channel.

Installing the CLI is only a fallback when oo is unavailable, and the declared runtime permission is limited to Bash(oo *). Automatic execution of mutable remote scripts therefore exceeds the minimum privileges required to use an already-installed Recruiterflow connector.

Attack Path

1. The oo command is unavailable, causing the user or agent to consult the first-time setup instructions.
2. An attacker compromises or gains influence over the installer response, its hosting pipeline, or the network resolution path.
3. The victim runs the documented curl | bash or irm | iex command.
4. The shell immediately interprets the attacker-controlled response without integrity or authenticity verification.
5. The payload executes with all privileges available to the invoking user and can perform further malicious actions.

Impact Assessment

...[truncated 820 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove direct curl | bash and irm | iex installation instructions.
2. Prefer a trusted platform package manager and pin the CLI to a reviewed version.
3. If script-based installation is unavoidable, download a versioned artifact to disk rather than executing the HTTP response directly.
4. Publish a SHA-256 checksum and, preferably, a cryptographic signature through an independently secured channel.
5. Verify the checksum and signature before execution, fail closed on any mismatch, and permit inspection of the downloaded script.
6. Document that installation must run without administrator or root privileges unless a specific, justified operation requires elevation.
7. Pin redirects and enforce HTTPS certificate validation; avoid mutable, unversioned installer endpoints.
8. Apply equivalent verification controls to both the Bash and PowerShell installation paths.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill instructs users to install software by piping a remotely fetched script directly into bash, which is a classic supply-chain risk. If the remote host, network path, or script content is compromised, arbitrary code would execute immediately on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use this skill for "ANY Recruiterflow request," which is an extremely broad activation condition without examples or constraints. This can overlap with many ordinary requests that merely mention Recruiterflow, making it unclear when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.