ClawHub
Back to skill

Security audit

AfrexAI Hiring Scorecard

Security checks for vulnerabilities and agentic risk

Overview

This is a simple hiring scorecard skill, but it gives hire/no-hire recommendations using sensitive candidate data without adequate privacy or bias safeguards.

Review this skill carefully before using it for real hiring. Keep candidate data minimal and access-limited, replace or remove 'culture fit' with job-related behavioral criteria, require evidence for every score, and follow your organization’s hiring, privacy, and record-retention rules.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill explicitly supports scoring and comparing job candidates, which involves handling sensitive evaluation data and potentially personal information, but it provides no warning about privacy, retention, access control, or fair-use considerations. In a hiring context, omission of these safeguards can lead to inappropriate sharing, biased decision-making, or noncompliant handling of employment-related records.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
Using 'culture fit' as a default criterion encourages subjective assessment that can act as a proxy for affinity bias or discrimination, especially because the skill presents it as a standard weighted factor without opt-in or bias warning. In hiring workflows, this can systematically skew rankings and recommendations against qualified candidates based on non-job-related traits.

Static analysis

No suspicious patterns detected.