SmartRecruiters

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:25 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a coherent SmartRecruiters read connector, but its setup instructions tell users to execute an unverified remote installer.

Review this skill before installing. It is suitable for SmartRecruiters read/search workflows, but do not let an agent run the documented curl-to-bash or irm-to-iex installer automatically; install the oo CLI through a trusted, verifiable method and connect only the SmartRecruiters account and scopes you intend to use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58
• Finding: Unverified Remote Installer Download and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 58–62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions pipe remotely downloaded content directly into Bash or PowerShell. The remote payload is executed without being saved for inspection, pinned to a reviewed version, or validated with a cryptographic signature or checksum. Although the scripts are hosted on an apparent vendor domain and installation is only suggested after an `oo: command not found` error, the effective executable payload remains mutable after the Skill has been reviewed. Compromise of the vendor domain, deployment pipeline, DNS or TLS trust chain, or the installer itself could therefore turn these instructions into arbitrary code execution. This installation method exceeds the minimum privilege necessary for the Skill's normal read-only SmartRecruiters functionality. The connector operations only require an already installed `oo` CLI; automatically executing an unverified installer is not necessary to inspect schemas or retrieve SmartRecruiters records. ### Attack Path 1. A user invokes the Skill on a system where the `oo` CLI is unavailable. 2. An attempted connector command fails with `oo: command not found`. 3. The agent or user follows the documented first-time setup instructions. 4. The shell downloads `install.sh` or `install.ps1` from the remote server. 5. Bash or PowerShell executes the response immediately without integrity verification. 6. If the remote distribution channel has been compromised, attacker-controlled commands execute with the privileges of the invoking account. 7. The payload may access that account's files and credentials, ...[truncated 777 chars]
• Remediation: ## Remediation Suggestions 1. Remove the pipe-to-shell and `Invoke-Expression` installation commands. 2. Direct users to an authenticated operating-system package manager or a version-pinned official release artifact. 3. If manual installation is required, download the installer to a local file without executing it: - Use an explicitly pinned release URL. - Publish a SHA-256 or stronger checksum through an independent trusted channel. - Verify a vendor cryptographic signature before execution. - Abort installation if any integrity or signature check fails. 4. Present the verified installer and its intended effects to the user, then require explicit approval before execution. 5. Run installation with the least-privileged account possible and avoid requesting administrator or root privileges unless a documented component strictly requires them. 6. Keep installation separate from normal connector execution so a failed read-only SmartRecruiters request cannot automatically lead to remote code execution. 7. Document the files, permissions, and system changes made by the installer and provide removal instructions.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill includes a one-line installer that fetches a remote script and pipes it directly into a shell, which is a classic supply-chain and remote code execution risk. If the install endpoint, transport, or upstream distribution is compromised, an agent or user following this guidance could execute arbitrary code on the host.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The description instructs the agent to use this skill for ANY SmartRecruiters request instead of calling the API directly, which is an overly broad routing rule. Broad mandatory invocation can cause the agent to over-trust this skill, increasing the chance that unsafe setup steps, shell commands, or future write-capable actions are used in contexts where narrower tool selection would be safer.

Static analysis

No suspicious patterns detected.