HR AI Assistant

• Outcome: Review
• Latest audit: May 28, 2026 · 4:50 AM UTC
• Version: 2.5.9

Overview

This HR assistant is mostly purpose-aligned, but it gives unsafe credential and sensitive-data handling instructions that users should review before installing.

Install only if you are comfortable sending HR questions and document context to HRrule. Do not paste real API keys into chat; use a protected environment variable or a carefully permissioned local config file instead. Prefer wss:// endpoints, avoid query-string API keys where possible, review any downloaded attachments before opening them, and avoid including unnecessary employee, compensation, legal, or company-confidential details in prompts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents capabilities to read environment variables, read/write local configuration, and make network/WebSocket calls, but does not declare permissions or present equivalent consent boundaries. That mismatch can cause the platform or user to invoke a skill with broader effective access than expected, increasing the risk of secret exposure or unintended outbound transmission.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation inconsistently says users can paste an API key into chat for automatic configuration, while elsewhere saying users must manually configure it and the system will not automatically save it. Contradictory secret-handling instructions are dangerous because they can lead users or integrators to expose credentials in chat transcripts or build unsafe auto-persistence behavior without clear safeguards.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The skill references different default WebSocket endpoints, including a public HRrule host and a private LAN address. Endpoint inconsistency is a security risk because deployers may accidentally connect to an unintended server, bypass expected trust boundaries, or leak HR data to the wrong destination.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script can automatically download and store attachments returned by the remote HRrule service, which exceeds simple Q&A/content-generation behavior and introduces a file-write capability. Any remote service compromise, prompt-injected response, or unexpected attachment reference could cause unreviewed files to be written locally, increasing risk of malware delivery or sensitive disk clutter.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The code writes downloaded files into a fixed directory under the user's home folder even though the skill metadata describes API interaction and HR content generation, not local file storage. This hidden persistence increases attack surface because users may not expect remote content to be stored on disk, and downstream tools or users may later trust those files.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The installation guide instructs users to place an API key in plaintext locations such as config.json and .env, or to export it directly in a shell, without warning about shell history, file permissions, accidental commits, or local credential exposure. This is a real security weakness because it normalizes insecure credential handling and can lead to credential leakage through source control, backups, shared terminals, or world-readable files.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README explicitly instructs users to paste their API key into the chat so the system can auto-configure it. In an agent/chat environment, conversation content may be logged, retained in history, exposed to operators, or leaked to other integrations, so this creates a direct secret-exposure path. Because this skill is specifically designed for conversational use, the context makes the issue more dangerous than a normal CLI setup example.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The README promotes automatic downloading of remote attachments to a local path without clearly warning that untrusted server-provided files will be written to disk. This can expose users to malicious or unexpected files, unsafe filenames, accidental overwrites, or opening attacker-controlled documents. In this skill context, downloads are a core feature, so the lack of safety guidance materially increases risk.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger guidance is broad enough to activate on many generic HR-related queries, which can cause unnecessary routing of user content to an external service. Because this skill handles potentially sensitive employment and legal questions, over-triggering increases privacy and data-sharing risk beyond user expectations.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The fallback rule routes unclear requests to broad defaults such as professional Q&A or generic policy generation. Ambiguous fallback behavior is risky because uncertain requests may still be sent to the external HR service without sufficient user intent or data minimization.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill encourages direct API integration and real-time streaming to HRrule but does not prominently warn users that their requests may be transmitted to an external third-party HR service. Given the HR/legal subject matter, users may share sensitive employee, compensation, or labor-dispute details without informed consent.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The guide explicitly encourages users to paste an API key into the chat for automatic configuration. Credentials entered into conversational channels may be logged, retained, exposed to other participants/integrations, or processed by systems not intended to store secrets, creating a real secret-handling vulnerability.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The document describes automatically forwarding DingTalk/QQ message contents to an external WebSocket/API service without an explicit disclosure, consent, or data-handling warning. In an HR context, messages may contain highly sensitive employee, legal, compensation, or disciplinary information, so silent third-party transmission materially increases privacy and compliance risk.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The example defaults to ws:// and sends the API key in the connection query string, exposing both credentials and HR chat content to interception on any untrusted network path. In this skill context, prompts and responses may include sensitive HR data, labor issues, compensation details, or employee information, which increases the confidentiality risk significantly.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation instructs clients to send the API key in a WebSocket query parameter, which is commonly captured in proxy logs, browser/network tooling, reverse-proxy access logs, and monitoring systems. In this skill’s context, the same connection also carries HR prompts and generated documents, so credential exposure can enable unauthorized access to sensitive HR workflows and data.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The documented endpoint uses unencrypted ws:// while transmitting both the API key and HR chat content, allowing anyone on the network path to intercept or tamper with traffic. Because this skill is for HR policy generation and consultation, intercepted data may include employment, compensation, labor-law, or other confidential organizational information, making the exposure especially severe.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script supports automatic download into the user's home directory via an environment flag without a prominent warning or consent flow at the point of write. Silent or poorly disclosed file creation is risky because users may unknowingly store untrusted remote content locally, enabling social engineering or accidental execution/opening of malicious files.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The instructions explicitly require reproducing full download URLs containing real temporary tokens in summaries. This can expose bearer-style access URLs in places beyond the original generation flow, increasing the chance of token leakage through chat logs, screenshots, browser history, analytics, or unintended recipients; in an HR context, those links may grant access to sensitive employee or recruitment documents.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: Encouraging users to disclose API keys in natural-language chat creates an easy and realistic channel for credential compromise. Secrets entered in chat may be persisted in logs, analytics, transcripts, model context, or downstream connectors, and the wording normalizes unsafe behavior. Since this is an agent skill for interactive conversations, the context makes the secret-handling weakness especially acute.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill explicitly instructs users to paste their API key into the chat so it can be automatically configured. This is dangerous because chat channels are often logged, retained, or visible to models, plugins, admins, or other integrations, turning a credential into conversation data and greatly increasing the chance of secret compromise.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Telling users to paste their API key directly into chat normalizes unsafe credential-sharing behavior and can result in immediate secret exposure through logs, transcripts, analytics, screenshots, or chat platform retention. Because this is operational guidance, users are likely to follow it, making the risk practical rather than theoretical.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The example explicitly depicts a user revealing their API key in conversation, reinforcing an insecure pattern and increasing the likelihood that real users will disclose valid credentials in monitored or shared channels. Examples strongly shape behavior, so this materially elevates credential compromise risk.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Repeating the instruction to paste the API key into conversation compounds the secret-handling problem by making unsafe behavior a documented feature. In a skill handling HR workflows, compromise of the API key could permit unauthorized use of the external service and exposure of sensitive HR-related prompts and outputs.

Context Leakage

High

• Category: Data Exfiltration

Content

1. **Parse Request:**
   - Identify: "招聘JD" → Tag ID: 4, RT: "招聘JD"
   - Extract context: 财务公司, 社保专员

2. **Construct Content:**
   ```python

• Confidence: 89% confidence
• Finding: The example workflow tells the platform to extract contextual details from the user request and send them to the external API as content. In an HR setting, that context can include employer identity, role details, and potentially sensitive personnel or business information, creating unnecessary data exposure if not minimized.

Context Leakage

High

• Category: Data Exfiltration

Content

1. **Parse Request:**
   - Identify: "员工手册" → Tag ID: 2, RT: "员工手册"
   - Extract context: 50人, 科技公司

2. **Call API:**
   ```python

• Confidence: 90% confidence
• Finding: This example encourages transmitting organizational context such as company size and industry to the external service. Even when not individually identifying, HR-related metadata can be commercially sensitive and may compound privacy risk when combined with other request details.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: assets/chat_example.html:248

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/api_reference.md:320