Security audit

Boss Cli

Security checks for vulnerabilities and agentic risk

Overview

This BOSS job-search skill is coherent, but it asks users to install an unaudited CLI that can read browser cookies and send account-linked messages to recruiters.

Review this carefully before installing. Prefer QR-code login over browser-cookie detection, install only from a trusted source or pinned version, and require explicit confirmation before any greet or batch-greet command that contacts recruiters from your account.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:8
Finding: Unpinned Third-Party Executable Dependency
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 8–14
Vulnerability Type: Unpinned package installation from a third-party registry
Risk Level: Medium

Vulnerable Code

bash
## Installation ```bash pip install kabi-boss-cli # or uv tool install kabi-boss-cli

text
### Technical Analysis The installation instructions retrieve and execute the latest available version of `kabi-boss-cli` without a version constraint, cryptographic hash, lockfile, or verifiable source revision. Consequently, the code executed by users can change after the Skill has been reviewed. The project contains only `SKILL.md`; it does not include the dependency's source code or other material that would permit verification of its behavior. This creates a supply-chain exposure if the package registry, publisher account, or a future package release is compromised. This finding does not establish that the current package is malicious. It establishes that the documented installation process does not provide reproducibility or integrity guarantees. ### Attack Path 1. An attacker compromises the package publisher account, package registry, or release process. 2. The attacker publishes a malicious version of `kabi-boss-cli`. 3. A user follows the documented unpinned installation command. 4. The package manager retrieves the attacker-controlled release. 5. Installation hooks or the installed CLI execute with the user's local privileges. 6. The malicious package may then access files and authentication material available to that user, including browser data requested by the documented login workflow. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privileges of the user installing or running the CLI. The accessible scope may include the user's files, environment variables, browser data, and BOSS session credentials. Administrative or root privileges are not demonstrated ...[truncated 61 chars]
Remediation: View remediation
Remediation Suggestions

Pin kabi-boss-cli to a specifically audited version.

Use package hashes or a lockfile to verify artifact integrity.

Link to the package's authoritative, auditable source repository and immutable release revision.

Document the expected package publisher and distribution source.

Recommend installation in an isolated environment with minimum privileges.

Establish a dependency review and update process before changing the pinned version.

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:16
Finding: Unaudited CLI Is Granted Access to Sensitive Browser Cookies
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 16–27
Vulnerability Type: Excessive access to browser authentication material
Risk Level: Medium

Vulnerable Code

bash
## Authentication ```bash # Automatically detect browser cookies (recommended) boss login # Specify browser boss login --cookie-source chrome # QR-code login boss login --qrcode

text
### Technical Analysis The recommended authentication workflow instructs the third-party CLI to discover or read browser cookie storage. Browser cookies can contain active authenticated sessions and are sensitive credentials. The documentation does not specify domain restrictions, the exact cookies collected, storage duration, local protection, destination endpoints, or whether raw cookie values are retained. Accessing BOSS authentication cookies may be consistent with the CLI's stated purpose, so the available evidence does not prove credential theft or exfiltration. However, making browser-cookie extraction the recommended default grants a package whose implementation is absent from the audited project access to sensitive browser state. The QR-code option provides an alternative that can avoid broad local browser-cookie access. ### Attack Path 1. A user installs the third-party CLI and invokes the recommended `boss login` command. 2. The CLI locates browser cookie databases or requests access to them. 3. The implementation reads authentication material available from the selected browser. 4. If the dependency is malicious or compromised, it captures, stores, or transmits session credentials. 5. An attacker reuses valid credentials to access the victim's BOSS account until the session is revoked or expires. ### Impact Assessment Potential impact includes unauthorized access to the user's BOSS account and exposure of profile data, job applications, interview invitations, browsing history, and communications with recruiters. A ...[truncated 251 chars]
Remediation: View remediation
Remediation Suggestions

Make QR-code authentication the recommended default.

Require explicit, informed user consent before reading browser cookie storage.

Restrict extraction to the minimum cookies required for the intended BOSS domain.

Clearly document which files, domains, and cookie fields are accessed.

Do not persist raw cookies unless strictly necessary; if persistence is required, use operating-system credential storage and restrictive permissions.

Never log cookie values, including in verbose or debugging mode.

Document credential retention, revocation, and logout behavior.

Publish auditable authentication code and document all endpoints receiving authentication data.

Isolate browser-cookie processing from unrelated CLI functionality and apply least-privilege controls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill description is broad enough to trigger on many ordinary job-search or career-related requests, which increases the chance the agent invokes this skill when the user did not explicitly ask to use BOSS直聘 or a third-party CLI. Because the tool can access account data and perform account-linked actions, overbroad activation raises the risk of unintended data access or side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings