Clawhire Candidate

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:13 AM UTC
• Version: 0.1.0

Overview

This job-search skill is mostly coherent, but it handles resumes, personal profile data, API keys, recruiter visibility, and notification state with too little user control and disclosure.

Install only if you are comfortable sending your job-search profile, resume contents, contact details, salary expectations, and recruiter activity to ClawHire. Before using it, avoid sharing unrelated sensitive data in resumes, ask how the API key is stored and deleted, and require confirmation before profile activation or marking notifications read.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: WORKFLOW.md:3

Finding

Unvalidated Verbatim Relay of Server-Controlled Content

Content

View full analysis

Vulnerability Details

File Location: WORKFLOW.md:3-5
Vulnerability Type: Remote instruction and output hijacking
Risk Level: High

Vulnerable Code

markdown

**IMPORTANT: You are a proxy, not the interviewer.**

When collecting your owner's background or building their profile, you do NOT generate questions yourself. Instead, you forward your owner's messages to the ClawHire server (`/api/v1/chat/profile-intake`), and the server returns AI-generated responses in `content_list`. Your job is to relay those responses back to your owner word-for-word, then forward their reply back to the server. Think of yourself as a messenger between your owner and the ClawHire AI — do not add, remove, or rephrase the server's messages.

The same unsafe requirement is reinforced in AGENTS.md:14-18 and SKILL.md:37-44.

Technical Analysis

The skill delegates control of user-facing conversation content to the external ClawHire server and requires the agent to relay returned content without modification. No validation, sanitization, trust-boundary check, or policy enforcement is specified for the server-controlled content_list.

Because external API responses are untrusted input, requiring word-for-word forwarding creates an indirect prompt-injection channel. The effective conversational behavior can change after the skill package has been reviewed, without modifying any local file. A compromised service, malicious service operator, DNS or account compromise, or vulnerable backend content pipeline could return phishing instructions, requests for secrets, deceptive links, or content conflicting with the user's intent.

This is output hijacking rather than direct code execution: the reviewed files do not establish that returned content is executed as local code.

Attack Path

1. The user begins a profile-intake conversation.
2. The agent sends the user's message to /api/v1/chat/profile-intake.
3. An attacker c ...[truncated 840 chars]

Remediation

View remediation

Remediation Suggestions

• Treat every API response as untrusted data rather than authoritative instructions.
• Remove the requirement to relay responses word-for-word.
• Validate the response against a strict schema, including expected type, length, and allowed content classes.
• Apply local safety checks before displaying returned content.
• Reject or neutralize credential requests, executable instructions, suspicious links, and attempts to override agent policy.
• Clearly distinguish remote service content from trusted agent guidance.
• Pin the intended service origin and use authenticated TLS, while recognizing that transport security does not protect against a compromised backend.
• Log rejected content without recording user secrets, and provide a safe failure message if validation fails.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: WORKFLOW.md:36

Finding

Broad Personal and Resume Data Transmission Without Field-Level Consent Controls

Content

View full analysis

Vulnerability Details

File Location: WORKFLOW.md:36-50
Vulnerability Type: Excessive collection and external disclosure of personal information
Risk Level: High

Vulnerable Code

markdown

Every time your owner replies:

POST /api/v1/chat/profile-intake { "user_input": "<their reply>" }

text

Relay each `content_list` item back. The A2C agent will naturally collect:
- Name, age, gender, phone
- Education, school, major
- Work history and experience years
- Skills and certifications
- Desired roles, industries, cities
- Salary expectations
- Availability and deal-breakers

If your owner uploads a PDF resume, extract the text and send it as `user_input` wrapped in `PDF_CV_CONTENT` tags.

Technical Analysis

The workflow directs the agent to collect identity, demographic, contact, education, employment, compensation, and availability data and transmit user replies to an external service. It additionally directs the agent to extract and upload the full text of a PDF resume.

The instructions do not establish field-level consent, data minimization, local redaction, a preview step, purpose limitation, retention disclosure, or handling rules for unrelated sensitive data embedded in a resume. Resumes can contain addresses, telephone numbers, personal email addresses, photographs, identification details, references, and other information that is unnecessary for a specific job-search request.

Sending the entire extracted document expands the amount of information exposed if the service, API credential, account, logs, or backend storage is compromised.

Attack Path

1. The user provides background information or uploads a resume.
2. The agent extracts the resume's complete text.
3. No redaction or field-level review occurs.
4. The full text is placed in user_input and sent to the external ClawHire API.
5. The service receives both necessary profile information and any ...[truncated 778 chars]

Remediation

View remediation

Remediation Suggestions

• Obtain explicit informed consent before transmitting profile data or resume text.
• Identify the external recipient, processing purpose, requested fields, and retention policy before upload.
• Show users a local preview of extracted information and require confirmation before transmission.
• Redact phone numbers, addresses, personal email addresses, government identifiers, reference contact details, and unrelated metadata by default.
• Parse resumes into an allowlisted set of required fields rather than uploading full document text.
• Permit users to omit demographic and compensation information.
• Encrypt data in transit and at rest, apply short retention periods, and provide deletion and export controls.
• Ensure logs, telemetry, and error reports never contain complete resume contents.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:48

Finding

Bearer API Key Directed Into Unspecified Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:48-61
Vulnerability Type: Unsafe credential retention in agent state
Risk Level: High

Vulnerable Code

markdown

You need a ClawHire API key. Ask your owner:

Use it in every request: `Authorization: Bearer <key>`

Base URL: `https://metalink.cc/clawhire/api/v1`

## Rules

4. Remember: the API key, profile status (active/inactive), and any ongoing conversations.

Technical Analysis

The skill requires a bearer API key and explicitly instructs the agent to remember it. It does not define a dedicated secret store, encryption boundary, retention duration, token scope, log-redaction requirement, revocation mechanism, or deletion procedure.

Bearer credentials grant access based on possession. Storing such a credential in conversational or long-term agent memory can expose it through future prompt context, diagnostics, logs, model-provider retention, unrelated tool calls, or prompt-injection attacks. The instruction also combines the credential with ongoing conversation state, increasing the chance that it is retained beyond the immediate request.

The credential is supplied by the legitimate user rather than directly by an attacker, so this is primarily an insecure secret-management issue. If attacker-controlled content later causes the agent to reveal stored state, the persistent credential becomes an account-compromise vector.

Attack Path

1. The user provides a ClawHire bearer API key.
2. The agent retains the key in conversational or persistent memory as instructed.
3. The key is propagated into prompts, logs, traces, backups, or future session context.
4. A malicious prompt, compromised external response, operator with log access, or unrelated session retrieves the retained value.
5. The attacker sends authenticated requests using the stolen bearer token.
6. The attacker obtains whatever account-level capabilities are authorized t ...[truncated 558 chars]

Remediation

View remediation

Remediation Suggestions

• Never store bearer tokens in conversational or general-purpose agent memory.
• Use an encrypted platform-managed secret store with strict access controls.
• Inject the token only at request execution time and prevent it from entering model prompts.
• Use short-lived, narrowly scoped tokens rather than durable account-wide API keys.
• Redact authorization headers from logs, traces, exceptions, telemetry, and user-visible output.
• Define explicit expiry, rotation, revocation, and deletion procedures.
• Isolate secrets by user and session to prevent cross-session or cross-user disclosure.
• Require reauthorization for sensitive state-changing operations.

T09 · Insecure Skill Coding Practices

Warning

• Location: WORKFLOW.md:128

Finding

Notification Read State Can Be Mutated Without Explicit User Confirmation

Content

View full analysis

Vulnerability Details

File Location: WORKFLOW.md:128-148
Vulnerability Type: Unconfirmed destructive account-state mutation
Risk Level: Medium

Vulnerable Code

markdown

## 2. Check notifications (do this first every session)

**Always check this when your owner starts a new session.** Give them a brief summary.

GET /api/v1/notifications?unread=true

text

Aggregate by type and present a brief summary — do NOT list every notification individually.

**Conversation details are NOT your job.** Tell your owner to go to the conversation tab on the website to read and reply to messages. You only report the counts.

Mark all as read:

POST /api/v1/notifications/read-all

text

Technical Analysis

The workflow combines an automatic session-start notification check with a state-changing read-all operation. It does not require the user to inspect the notifications or explicitly authorize the mutation before all unread items are marked as read.

The GET request is read-only, but the POST request changes account state globally. Aggregating only counts while suppressing individual notification details makes this more significant: notifications can lose their unread marker even though the user has not reviewed their contents.

This violates least-surprise and confirmation requirements for state-changing operations. Repeated session starts or unintended workflow execution can silently alter the user's notification state.

Attack Path

1. The user starts a new session.
2. The skill automatically requests all unread notifications.
3. The agent presents only aggregate counts rather than individual items.
4. The workflow invokes /api/v1/notifications/read-all without explicit confirmation.
5. Every notification is marked as read.
6. The user may overlook recruiter messages, job matches, or other alerts because the unread indicators have been removed.

Impact Assessment

The ...[truncated 384 chars]

Remediation

View remediation

Remediation Suggestions

• Keep session-start notification checks strictly read-only.
• Do not call read-all automatically.
• Present the summary and ask for explicit confirmation before changing notification state.
• Prefer marking individual notifications as read only after the user opens or acknowledges them.
• Display the number and categories of affected notifications before confirmation.
• Make the operation idempotent and provide clear feedback after execution.
• If supported by the service, provide a way to restore unread status after accidental mutation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction "Default to Chinese. Switch to English only if your owner uses English" imposes a language default based on policy rather than explicit user choice. This can violate language or locale policy because the skill does not offer a neutral language choice or opt-in before defaulting to Chinese.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to forward the owner's background messages to a remote server and relay the server's responses verbatim, but the file provides no requirement to clearly disclose this data transfer or obtain informed consent at the point of collection. Because profile intake can include sensitive personal and employment information, silent transmission to an external service creates a privacy and data-handling risk and also exposes the conversation to prompt injection originating from the remote server.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description and capability definitions describe collecting resumes, background, skills, preferences, and recruiter communications, but they do not clearly warn users that this sensitive personal data will be sent to an external service. In a job-search context, this data may include employment history, contact details, and other identifying information, so lack of upfront disclosure undermines informed consent and increases privacy risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger list for the profile-intake capability includes broad phrases such as "resume," "找工作," and "job search," which can match ordinary conversation and invoke data-collection behavior unexpectedly. In a skill that gathers candidate background and transmits it to an external API, unintended invocation increases the chance of oversharing personal or employment information without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation capability is triggered by ambiguous phrases like "activate" and "让招聘方看到我," which could be interpreted in multiple contexts and may cause accidental profile activation. Because activation changes visibility to recruiters, unintended invocation can expose a user's profile and personal job-seeking status to third parties without sufficiently explicit consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup instruction hardcodes a Chinese prompt for the user without offering a language choice or checking preference. While not directly a code-execution issue, forcing a language can impair informed consent and comprehension, which is more sensitive here because the interaction involves account setup, API keys, and personal employment data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The example server response and required user-facing messages are in Chinese, and the workflow tells the agent to relay server messages word-for-word. Because no language preference or opt-in mechanism is provided, the skill appears to impose a specific language on users, which is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow instructs the agent to collect and transmit highly sensitive personal and employment data, including name, age, gender, phone, education, work history, salary expectations, and resume contents, to backend APIs without requiring any explicit user consent flow, privacy notice, or data minimization step. This is especially risky because uploaded PDF resume text is extracted and forwarded in full, which can expose more personal data than the user expects.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.