jd-market-research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent recruiting research assistant, but it ships and reuses a plaintext company recruitment profile containing sensitive compensation and hiring details.

Review this skill before installing. It does not appear to execute code or exfiltrate data, but it stores and ships sensitive recruiting information in plaintext. Remove the populated company profile, use only a sanitized template, and only save real company data with explicit user consent, clear retention rules, and protected user- or company-scoped storage.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:70
• Finding: Unprotected Persistent Storage of Internal Recruitment Information## Vulnerability Details **File Location**: `SKILL.md`, lines 70-124 **Vulnerability Type**: Plaintext persistence of potentially sensitive business information **Risk Level**: Medium ### Evidence The relevant Skill instructions and storage template are reproduced below in English: ```markdown ### 2.3 Save Company Profile After the user confirms the information, write it to `references/company-profile.md`: # {Company Name} Recruitment Profile > Creation date: {YYYY-MM-DD} > Last updated: {YYYY-MM-DD} ## Compensation Structure - Base range: {XX-XXK} - Annual bonus: {X months} - Annual salary months: {X-X} - Stock/options: {Yes/No}, {specific rules} ## Job-Level Structure - Level sequence: {sequence} - Target level: {level} - Comparable levels: {levels at other companies} ## Recruitment Preferences - Headcount type: {new/replacement/expansion} - Target companies: {Company A, Company B} - Industry-background requirements: {requirements} - Expected start date: {period} - Remote-location candidates: {accepted/not accepted} ## Notes - {Internal restrictions or reporting relationships} ### 2.4 Profile Update Rules - Whenever the user provides new internal information, update `company-profile.md`. - Reuse company information for roles at the same company. - Before each analysis, ask whether the information has changed. ``` ### Technical Analysis The Skill explicitly directs the agent to persist user-provided internal recruitment information in a plaintext Markdown file inside the Skill package. The stored fields can include salary budgets, equity-grant rules, headcount status, target companies, hiring preferences, reporting relationships, and other internal notes. No corresponding controls are specified for: - Explicit consent to durable storage - User or tenant isolation - File access restrictions - Encryption at rest - Data minimization or redaction - Retention pe ...[truncated 2002 chars]
• Remediation: ## Remediation Suggestions 1. Do not store user-provided recruitment information inside the distributable Skill package. 2. Require explicit, informed user consent before any durable storage operation. 3. Use protected, user-scoped or tenant-scoped storage rather than a shared Markdown file. 4. Apply restrictive file permissions and encryption at rest where supported. 5. Store only the minimum fields required for the stated workflow; redact personal data and unnecessary internal details. 6. Define a retention period and provide commands to review, update, export, and securely delete the profile. 7. Verify that the current user is authorized to access a saved profile before loading or displaying it. 8. Ask for confirmation before reusing saved information in a new session or for a different company or role. 9. Add the populated profile path to packaging and version-control exclusion rules. 10. Maintain a sanitized, empty template in the repository and store actual profiles outside the project tree.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/company-profile.md:1
• Finding: Organization-Specific Recruitment Profile Distributed in Plaintext## Vulnerability Details **File Location**: `references/company-profile.md`, lines 1-53 **Vulnerability Type**: Prepopulated plaintext business information in a reusable Skill package **Risk Level**: Medium ### Evidence The populated profile contains the following organization-specific information, reproduced in English: ```markdown # Vipshop Recruitment Profile > Creation date: 2025-05-06 > Last updated: 2025-05-06 ## Compensation Structure - Base range: 25-35K - Annual bonus: 1-2 months for normal performance - Annual salary months: 13-14 - Stock/options: Available; V5 receives 200-500 ordinary VIPS shares, granted once and vested over four years ## Recruitment Preferences - Headcount type: Replacement for a departing employee - Target companies: Major Internet companies; e-commerce preferred, social-platform backgrounds accepted - Industry requirement: E-commerce preferred; social/content backgrounds accepted - Expected start date: 1-1.5 months - Candidates from other locations: Accepted; employee housing is provided ## Notes - V5 is a mid-to-senior level expected to independently own module development - The team atmosphere is described as moderate and not highly competitive - The team is described as generally not requiring overtime and providing weekends off - iOS is described as a core business department, with the application carrying more than 90% of GMV and having extremely high stability - Important: the shares are ordinary shares; one ordinary share equals five ADS ``` ### Technical Analysis The package contains a populated company profile rather than an empty or synthetic template. It includes specific compensation ranges, equity mechanics, headcount status, recruitment preferences, benefits, team-working conditions, and business-stability assertions. The Skill is designed to detect this file and propose reusing its contents. Consequently, simply distributing the proje ...[truncated 1893 chars]
• Remediation: ## Remediation Suggestions 1. Remove the populated organization-specific profile from the distributable project. 2. Replace it with an empty template containing clearly synthetic examples. 3. Review the existing content with the relevant data owner and confirm whether any disclosure requires incident handling. 4. Keep real profiles in protected storage outside the repository and Skill installation directory. 5. Add `references/company-profile.md` or the directory containing generated profiles to version-control and packaging exclusion rules. 6. Introduce per-user and per-organization profile isolation. 7. Require authorization and explicit confirmation before displaying or reusing an existing profile. 8. Record the source, collection date, confidence, and approved use for every retained factual claim. 9. Establish expiration rules so stale compensation, staffing, and business information is not reused indefinitely. 10. Add an automated packaging check that rejects artifacts containing populated profile fields or organization-specific operational data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs writing sensitive recruiting and compensation data to a local file (`references/company-profile.md`) and repeatedly reusing it, but it does not require user consent, warn about persistence, or set any data minimization boundaries. In this context, the stored data can include internal salary bands, equity rules, hiring strategy, org structure, and recruiting preferences, which are confidential business information and could later be exposed to other tasks, users, or tooling that can read the workspace.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The skill manifest describes triggers and behavior entirely in Chinese, which effectively fixes the interaction language without stating that users may choose another language. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is documented and justified.

Static analysis

No suspicious patterns detected.