Back to skill

Security audit

RoboHire

Security checks for vulnerabilities and agentic risk

Overview

This skill is a static RoboHire reference page that directs users to an external recruiting platform and does not install code, run commands, or access local data.

Before using RoboHire, confirm your organization has authority to upload candidate resumes and run AI-assisted interviews, provide required notices or consent, and review privacy, retention, anti-discrimination, and local hiring-law obligations. The skill itself is informational, but the referenced service handles sensitive hiring data.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill promotes automated interview outreach and AI video interviewing with real-time analysis but does not warn about notice, consent, biometric/privacy implications, or jurisdiction-specific legal requirements. Because this is a hiring context involving candidates, omission of these safeguards can normalize covert or noncompliant monitoring and outreach practices.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs users to upload resumes and rely on AI screening/evaluation, which inherently involves processing sensitive personal data such as contact details, employment history, and potentially protected characteristics. Presenting this workflow without any privacy, retention, consent, or secure-handling guidance can lead users to process candidate data in ways that violate internal policy or data protection obligations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.