T01 · Skill Instruction Hijacking
Error
- Location
WORKFLOW.md:1- Finding
Remote Service Controls Agent Responses Through Mandatory Verbatim Relay
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawhire Recruiter
Security checks for vulnerabilities and agentic risk
Overview
This recruiter skill is mostly aligned with ClawHire hiring work, but it asks to store an API key, blindly relay remote AI messages, and automatically mark notifications as read without clear user control.
Install only if you trust the ClawHire service with hiring details and candidate-search activity. Use a revocable, least-privilege API key if available, avoid pasting long-lived secrets into ordinary chat, and watch for automatic notification read status changes or remote messages that ask for unrelated sensitive information.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:41- Finding
Bearer API Key Is Requested for Persistent Agent Memory Without Secure Storage Controls
- Content
View full analysis
` Base URL: `https://metalink.cc/clawhire/api/v1` ``` `SKILL.md:50-55`: ```markdown ## Rules 1. Never publish a job without your owner confirming. 2. Never share candidate real names or phone numbers. 3. Never fabricate data. Ask your owner if something is missing. 4. Remember: the API key, active job IDs, and anything unfinished. ``` ### Technical Analysis The Skill asks the user to provide a bearer credential and explicitly instructs the Agent to remember it. It does not define a secure secret store, encryption requirements, credential scope, retention period, redaction policy, expiry procedure, or deletion mechanism. A bearer token provides access based solely on possession. Storing it in conversational or general-purpose Agent memory risks exposing it through logs, context replay, memory retrieval, debugging exports, backups, or later unrelated interactions. The lack of a separation between secrets and ordinary workflow state is especially concerning because the same instruction also groups the API key with non-secret job identifiers and unfinished task data. The source files do not contain a hardcoded API key. The vulnerability concerns how a user-supplied key is collected and retained. ### Attack Path 1. The Skill asks the user to provide a ClawHire API key. 2. The user enters the key into the conversation. 3. The Agent retains the credential under the instruction to remember it. 4. The credential becomes part of conversational history, general memory, telemetry, or another storage mechanism not designed for secrets. 5. A later prompt, memory lookup, log v ...[truncated 772 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
WORKFLOW.md:112- Finding
Notifications Are Automatically Marked Read Without Explicit User Authorization
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (11)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Confirm with owner first:
text DELETE /api/v1/jobs/<id>5. Check notifications (do this first every session)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction "Default to Chinese. Switch to English only if your owner uses English" imposes a language preference by default rather than offering the user a choice. This matches the policy category for language or locale constraints without explicit opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to forward the owner's messages to an external server and to relay the server's content exactly as-is, but it does not warn the user that their input will be transmitted off-platform. In a recruiting context, owner messages may contain sensitive company, hiring, or candidate information, so silent transmission creates a meaningful privacy and data-handling risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The hiring-intake capability uses very broad trigger phrases such as "hire," "recruit," and similar multilingual variants, which can match ordinary conversation and activate the skill unintentionally. Because this skill can initiate a guided workflow that collects hiring details and may lead toward job publication, accidental activation can expose recruiter intent, collect sensitive business information, or start unintended external API interactions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The candidate-search capability includes generic trigger language like "候选人" and "找人," which can be used in many normal conversations unrelated to recruiting. In a skill that queries candidate data, overly generic activation increases the chance of unintended access to search functionality and accidental exposure of recruiting-related information or outbound requests.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The setup instruction hard-codes a Chinese prompt to the owner without checking the user's preferred language. While this is not a direct exploit primitive, it can mislead or confuse users, reduce informed consent during credential collection, and increase the risk of users providing API keys without fully understanding what is being requested.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The example server content is in Chinese, and later required user-facing messages are also prescribed in Chinese, such as the publication confirmation and notification summary examples. The workflow does not offer the user a language choice or explain a justified locale restriction, which creates a language policy issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This line mandates a specific Chinese confirmation message to the owner after publishing. Because the workflow requires that output regardless of user preference and provides no language-selection mechanism, it violates the language/locale policy criteria.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill's manifest describes a guided job-posting flow, but the workflow also grants broader recruiter and account-management capabilities such as listing, updating, deleting jobs, searching candidates, checking notifications, and retrieving account info. This expands the action surface beyond user expectations and increases the chance of unintended or unauthorized operations, especially because some actions can alter account state or expose sensitive business activity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The workflow instructs the agent to automatically read notifications at the start of every session and then mark them all as read, without first obtaining user consent. This both accesses account activity the user may not have asked to disclose and performs a state-changing action that can destroy unread status, potentially causing missed items or audit ambiguity.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The workflow includes unrestricted account information retrieval even though the stated purpose is helping post jobs and find candidates. Unnecessary account access violates least privilege and may expose profile, billing, or organizational metadata not needed for the main task.
- Content
Static analysis
No suspicious patterns detected.