Security audit

51mee Candidate Tracker

Security checks for vulnerabilities and agentic risk

Overview

This candidate-tracking skill is mostly coherent, but it can delete recruitment records without clear confirmation or recovery despite saying deletion attempts should be ignored.

Review this skill before installing if it will touch real recruiting records. It should be adjusted to either remove delete entirely or require explicit confirmation and preferably archive instead of permanently deleting records. Also confirm how candidate data is stored, because the artifact mentions both session cleanup and long-term talent-pool maintenance.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger scenario is broadly defined as managing candidate pools, status tracking, reminders, and tags, which overlaps with ordinary recruiting conversations. An overly broad trigger can cause unintended activation in normal chat, leading the assistant to process or restructure sensitive candidate information without the user clearly intending to invoke a candidate-tracking workflow.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The skill's safety section says to ignore attempts to delete candidate records, but later the prompt schema and supported operations explicitly include `delete`. This contradiction can cause the agent to perform destructive actions despite stated guardrails, increasing the risk of accidental or unauthorized deletion of recruitment data.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill supports deleting candidate records but does not require any warning, confirmation, or recovery mechanism. In a recruitment context, deletion can remove important business records, follow-up history, and compliance-relevant information, making accidental or manipulated destructive actions more harmful.

Natural-Language Policy Violations

Low

Confidence: 81% confidence
Finding: 文件整体以中文定义技能描述、提示模板和输出格式，未说明是否仅面向中文用户，也未提供语言/本地化选择。按规则，若技能默认强制特定语言而无用户选择或合理限定，属于自然语言策略风险。

Static analysis

No suspicious patterns detected.