Security audit

HR AI Assistant

Security checks for vulnerabilities and agentic risk

Overview

This HR assistant has a coherent purpose, but it handles API keys and sensitive HR content in ways users should review carefully before installing.

Install only if you are comfortable sending HR questions and document context to HRrule. Do not paste real API keys into chat, avoid the ws:// browser example, prefer a protected local secret store, and avoid including employee PII, compensation, medical, disciplinary, or legal details unless you have authorization and a data-processing basis.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (10)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:6
Finding: Mandatory Promotional Output Hijacks Agent Responses
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: MEMORY.md:1
Finding: Persistent Memory Rules Require Reproduction of Tokenized Download Links
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/call_hrrule_api.py:161
Finding: Arbitrary WebSocket Endpoint Receives API Key and Full HR Prompt
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/call_hrrule_api.py:367
Finding: Command-Line API Key Masking Does Not Hide Operating-System Process Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/config_api_key.py:33
Finding: API Key Is Echoed During Entry and Stored Without Enforced Owner-Only Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: assets/chat_example.html:115
Finding: Browser Example Sends Credentials and HR Content to a Configurable Plaintext Endpoint
Content: View full analysis
WebSocket address:
API Key:
``` ```javascript const content = userInput.value.trim(); const apiKey = document.getElementById('apiKey').value.trim(); const wsUrl = document.getElementById('wsUrl').value.trim(); const socketOptions = { transports: ['websocket', 'polling'], reconnection: false, query: { api_key: apiKey } }; socket = io(wsUrl, socketOptions); ``` ### Technical Analysis The browser example combines three unsafe practices: 1. It defaults to an unencrypted `ws://` endpoint. 2. It accepts an arbitrary destination from a text field. 3. It sends the API key as a query parameter. The API-key field is also a normal text input rather than a password input. If the connection remains plaintext, network observers can intercept both the API key and HR request. If the user changes the destination to an attacker-controlled endpoint, the browser voluntarily supplies the key and content to that endpoint. ### Attack Path 1. A user opens the included HTML example. 2. The user enters an API key and confidential HR request. 3. The page connects to the default plaintext endpoint or a destination supplied by an attacker. 4. The API key is sent as part of Socket.IO connection parameters. 5. The complete prompt is sent after connection. 6. A network observer or destination operator captures both values. ### Impact Assessment The attacker can obtain: - The HRrule API key. - Full HR prompt content. - Potential employee and candidate personal inf ...[truncated 212 chars]
Remediation: View remediation
` for secret entry, while recognizing that this only prevents visual exposure. - Do not place API keys in query strings. - Prefer a trusted backend that holds the API key and proxies authorized requests. - Add a clear warning against entering real employee or candidate information into a demonstration page. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: USAGE_GUIDE.md:21
Finding: Documentation Instructs Users to Paste Secrets into Chat and Use Plaintext WebSockets
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: INSTALL.md:72
Finding: Unpinned Python Packages and CDN-Hosted Executable JavaScript Create Supply-Chain Risk
Content: View full analysis
``` ### Technical Analysis The Python installation commands do not pin reviewed package versions or hashes. A future incompatible or compromised package release could therefore be installed without review. The browser example loads executable JavaScript from a CDN without Subresource Integrity. Although a version appears in the URL, the browser does not cryptographically verify the response against a trusted hash. A compromised CDN, account, or network trust chain could supply modified JavaScript. The externally supplied JavaScript runs in the same page that receives the user's API key and HR prompt, making dependency compromise particularly sensitive. ### Attack Path 1. A user runs the unpinned `pip install` command or opens the browser example. 2. The package repository or CDN supplies dependency content at that time. 3. A compromised or unexpectedly changed dependency executes in the user's environment. 4. Malicious browser code reads the API key and prompt directly from the page. 5. Malicious Python package code can execute with the privileges of the installing or running user. ### Impact Assessment For the browser path, an attacker can steal entered credentials and HR content within the page's origin and browser capabilities. For the Python path, a compromised dependency can execute with the current user's privileges, potentially accessing files and credentials available to that user. No evidence establishes that the named packages are currently malicious; the confirmed issue is the absence of reproducible and integrity-verified dependency controls. ]]>
Remediation: View remediation

other

Warning

Location: scripts/call_hrrule_api.py:190
Finding: Full Sensitive HR Requests Are Automatically Disclosed to an External Processor Without a Data-Minimization Boundary
Content: View full analysis
Remediation: View remediation

other

Warning

Location: scripts/call_hrrule_api.py:17
Finding: Missing Download Helper Prevents Review and Execution of Security-Critical Attachment Logic
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (53)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · INSTALL.md (reported line 63)May include surrounding context.
}

text
#### 方式 D: 创建 .env 文件 ```bash # 复制示例文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · INSTALL.md (reported line 69)May include surrounding context.
}

text
#### 方式 D: 创建 .env 文件 ```bash # 复制示例文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · INSTALL.md (reported line 97)May include surrounding context.
}

text
#### 方式 D: 创建 .env 文件 ```bash # 复制示例文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
}

text
#### 方式 D: 创建 .env 文件 ```bash # 复制示例文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · USAGE_GUIDE.md (reported line 74)May include surrounding context.
}

text
#### 方式 D: 创建 .env 文件 ```bash # 复制示例文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · INSTALL.md (reported line 67)May include surrounding context.
bash
# 复制示例文件 cp .env.example .env # 编辑 .env 文件,填入你的 API Key

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 104)May include surrounding context.
bash
# 复制示例文件 cp .env.example .env # 编辑 .env 文件,填入你的 API Key

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior does not cleanly match the declared purpose: the skill is presented as HR content generation, but the file also instructs the platform to manage local credentials and configuration state. This mismatch can mislead users and operators about what the skill actually does, reducing informed consent and increasing the chance that sensitive operations occur unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill omits a clear warning that user HR questions and document contents may be sent to an external service. This is especially dangerous because HR workflows commonly include personally identifiable information, employment details, compensation data, and legal matters that users may not expect to leave the local platform.
Content: No source excerpt is available for this finding.

Context Leakage

High

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The workflow explicitly instructs the platform to extract user context and forward it as content to the external HR service. In an HR/recruiting setting, that context can easily include employer identity, role details, and sensitive workforce information, creating meaningful risk of privacy leakage if transmitted without minimization and consent.
Content: Scanner excerpt · SKILL.md (reported line 493)May include surrounding context.

Parse Request:

Identify: "招聘JD" → Tag ID: 4, RT: "招聘JD"

Extract context: 财务公司, 社保专员

Construct Content:

python

Context Leakage

High

Category: Data Exfiltration
Confidence: 94% confidence
Finding: This example forwards organizational context such as company size and industry to the remote service as part of the generated request. While useful for generation, these details may still be sensitive internal information and should not be transmitted automatically without clear disclosure and necessity checks.
Content: Scanner excerpt · SKILL.md (reported line 528)May include surrounding context.

Parse Request:

Identify: "员工手册" → Tag ID: 2, RT: "员工手册"

Extract context: 50人, 科技公司

Call API:

python

Context Leakage

High

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The example extracts department context and sends it to the external API. On its own this is less severe than employee PII, but in aggregate it still leaks internal organizational structure and business-process details to a third party.
Content: Scanner excerpt · SKILL.md (reported line 552)May include surrounding context.

Parse Request:

Identify: "KPI考核表" → Tag ID: 3, RT: "KPI考核表"

Extract context: 销售部门

Call API:

python

Context Leakage

High

Category: Data Exfiltration
Confidence: 96% confidence
Finding: This example involves labor-law questions about protected categories such as pregnancy, maternity, and breastfeeding status, then instructs the platform to extract and send that context externally. Protected employment and health-adjacent information is particularly sensitive, so automatic transmission meaningfully increases privacy and compliance risk.
Content: Scanner excerpt · SKILL.md (reported line 576)May include surrounding context.

Parse Request:

Identify: Question about labor law/employee rights → Tag ID: 1, RT: "专业问答"

Extract context: 三期员工 (孕期、产期、哺乳期), 特殊保障

Call API:

python

Context Leakage

High

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The example extracts resignation-related context and forwards it externally. Employment status and separation matters can be sensitive personnel information, and the workflow provides no warning, minimization, or approval control before sharing it.
Content: Scanner excerpt · SKILL.md (reported line 630)May include surrounding context.

Parse Request:

Identify: Question about resignation → Tag ID: 1, RT: "专业问答"

Extract context: 员工离职, 提前通知时间

Call API:

python

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly instructs users to paste their API key into the chat for automatic configuration, creating a direct natural-language path for secret disclosure. Chat messages are commonly logged, retained, surfaced to models, or visible to operators, so this pattern materially increases the chance of credential compromise.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Telling users to paste API keys into chat for automatic configuration explicitly encourages disclosure of secrets in an unsafe channel. In chat-integrated environments like DingTalk/QQ/WorkBuddy, messages may be logged, forwarded, or accessible to admins and plugins, making credential theft materially more likely.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The example conversation normalizes sending an API key in plain text and rewards the behavior with successful configuration. This socializes insecure practices and can cause users to expose valid keys in retained chat transcripts.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Repeating that users can directly paste API keys in conversation reinforces secret exposure and increases the chance of accidental compromise. The risk is elevated by the skill's messaging-platform integrations, where conversational data commonly traverses multiple services.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The example defaults the WebSocket endpoint to an unencrypted ws:// URL while collecting an API key and HR chat content in the browser. This exposes credentials and potentially sensitive HR/legal data to interception or modification by any attacker on the network path, and the page provides no warning to users that transport security is absent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file title and all user-facing changelog content are presented only in Chinese, indicating the skill documentation is effectively constrained to a single language. There is no indication that users may choose another language or that the locale restriction is intentional and justified for a region-specific skill.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · CHANGELOG.md (reported line 79)May include surrounding context.
md
- 避免打包时包含敏感信息 2. ✅ **修复 SSL/TLS 安全问题** - 移除 `ssl_verify=False` - 使用安全的 SSL 上下文：`ssl.create_default_context()` - 确保 HTTPS 连接的安全性

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · CHANGELOG.md (reported line 79)May include surrounding context.
md
- 避免打包时包含敏感信息 2. ✅ **修复 SSL/TLS 安全问题** - 移除 `ssl_verify=False` - 使用安全的 SSL 上下文：`ssl.create_default_context()` - 确保 HTTPS 连接的安全性

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The installation guide instructs users to place an API key in config.json or a .env file, but it does not warn that these files contain secrets that must be protected and excluded from version control. This can lead to accidental credential exposure through repository commits, shared workspaces, backups, or permissive file access, which would allow unauthorized use of the HRrule API.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The title and all operational instructions are written as mandatory Chinese-language guidance, with no indication that the assistant should adapt to the user's preferred language. This can violate language/locale policy when a skill implicitly constrains output language without offering user choice.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The memory explicitly instructs the agent to reproduce full download URLs containing real temporary tokens in summaries. Those URLs are bearer-style secrets: anyone who sees them in chat logs, transcripts, analytics pipelines, or downstream model context may be able to access attached HR documents without further authentication. In an HR skill, the risk is elevated because generated files may contain sensitive employee, recruiting, compensation, or policy data.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: assets/chat_example.html:248

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/api_reference.md:320