boss-greeting message

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:06 AM UTC
• Version: 1.0.0

Overview

The skill has a legitimate job-application purpose, but it asks users to install and use an unpinned third-party CLI that may access browser login cookies.

Before installing, verify the `kabi-boss-cli` source and version, prefer QR login over browser-cookie access if possible, and provide only the resume fields needed for the greeting rather than a full sensitive resume file.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:22

Finding

Unpinned Third-Party CLI Can Access Browser Authentication Cookies

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 22-32
Vulnerability Type: Supply-chain risk from an unpinned third-party executable
Risk Level: Medium

Vulnerable Code

markdown

- **Not logged in** → Prompt the user:

  > Log in to BOSS Zhipin first:
  > ```bash
  > boss login
  > ```
  > This automatically reads browser cookies or displays a QR code for login.
  > Trigger this skill again after login.

  > If boss-cli is not installed, install it first:
  > ```bash
  > uv tool install kabi-boss-cli
  > ```

The original instructions direct the user to install kabi-boss-cli without pinning a version, validating a package hash, identifying a reviewed source revision, or performing any other integrity verification. The same workflow states that the resulting executable can automatically read browser cookies.

Technical Analysis

Installing a package by its mutable registry name delegates trust to the package registry, publisher account, dependency resolution process, and latest available release. The project contains only skill.md; it does not include the CLI implementation or a lockfile, so the installed code and its transitive dependencies cannot be audited from this artifact.

This creates a supply-chain exposure because a compromised publisher account, malicious future release, dependency-confusion event, or compromised transitive dependency could execute arbitrary code under the user's account. The risk is elevated by the documented authentication workflow: the executable may access browser-held BOSS session cookies, which are sensitive bearer credentials.

This finding does not establish that kabi-boss-cli is currently malicious. It identifies the unsafe installation and trust model documented by the skill.

Attack Path

1. An attacker compromises the package publisher, registry distribution path, or one of the package's dependencies and publishes a malicious versi ...[truncated 1303 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin kabi-boss-cli to a specific, security-reviewed version rather than installing the latest mutable release.
2. Require cryptographic hashes for the package and all resolved dependencies, using a lockfile or package-manager mode that enforces hash verification.
3. Document the canonical source repository, package publisher, reviewed commit, and expected package signature or checksum.
4. Audit the CLI and its transitive dependencies, particularly code that accesses browser profiles, cookie databases, process environments, and network destinations.
5. Prefer QR-based or official OAuth-style authentication that does not require reading browser cookie stores.
6. If cookie access is unavoidable, restrict it to the minimum required BOSS cookie data, obtain explicit user consent, avoid logging or persisting credentials, and document where authentication data is transmitted.
7. Run the CLI with least privilege in an isolated environment, without administrator rights and without unnecessary access to unrelated files, credentials, or browser profiles.
8. Establish an update-review process so that changing the pinned version requires renewed source and dependency inspection.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says the skill triggers when the user says phrases like “帮我写打招呼语” and similar examples, but it does not define a bounded trigger set or exclusion conditions. Phrases about writing a greeting can occur in ordinary conversation and may overlap with requests outside the intended BOSS直聘 context, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill asks the user for a resume file path and then reads resume contents, which may include highly sensitive personal data such as phone numbers, email, work history, education, and identifiers, without any explicit privacy notice, minimization guidance, or consent boundary. In this context, the danger is elevated because the skill also combines resume data with externally fetched job information, increasing the amount of personal profiling and the risk of over-collection or accidental disclosure through logs, prompts, or downstream tools.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.