review simulate

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:03 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Chinese voice interview simulator, but users should understand that it sends interview audio and generated text to configured cloud AI services and saves reports locally.

Install only if you are comfortable sharing interview audio, transcripts, prompts, and summaries with the configured LLM/ASR/TTS providers. Use private output locations, avoid sensitive personal details in practice answers, consider --no-tts when voice playback is not needed, and prefer pinned dependency versions and deletion of saved reports/audio after use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/run_interview.py:305

Finding

Excessive Persistence of Raw ASR Provider Responses

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/run_interview.py:160

Finding

Prompt Injection Through Untrusted Candidate Answers and Interview History

Content

View full analysis

dict[str, Any]: user_prompt = f"""输入： - 当前问题：{question} - 问题类型：{question_type} - 用户回答：{answer} - 历史摘要：{history_summary} 请输出 JSON，字段包括： - relevance - clarity - specificity - persuasiveness - brief_comment - gap_summary 要求： - 四维评分使用 1-5 分整数 - brief_comment 控制在 1-2 句 - 评语具体，不要空泛夸奖 - gap_summary 只总结最需要追问或改进的点 """ return llm_json(EVALUATION_SYSTEM_PROMPT, user_prompt) ``` ```python def generate_next_question( decision: dict[str, Any], current_answer: str, history_summary: str, config: dict[str, Any], ) -> dict[str, Any]: user_prompt = f"""输入： - 决策结果：{json.dumps(decision, ensure_ascii=False)} - 当前用户回答：{current_answer} - 历史摘要：{history_summary} - 目标岗位：{config['target_role']} - 面试官风格：{config['interviewer_style']} 请输出 JSON，字段包括： - next_question - question_type 要求： - 如果 action=follow_up，围绕上一轮缺口深挖 - 如果 action=new_question，自然切换到未充分覆盖的维度 - 每次只生成一个问题 - 语言自然，像真实中文面试官 """ return llm_json(NEXT_QUESTION_SYSTEM_PROMPT, user_prompt) ``` ```python def generate_final_report(turns: list[dict[str, Any]], config: dict[str, Any]) -> dict[str, Any]: user_prompt = f"""输入： - 全部轮次记录：{json.dumps(turns, ensure_ascii=False)} - 会话配置：{json.dumps(config, ensure_ascii=False)} 请输出 JSON，字段包括： - overall_score - dimension_scores - strengths - weaknesses - round_summaries - improvement_suggestions - sample_better_answer - final_summary_text 要求： - 反馈要具体、可执行 - strengths 和 weaknesses 各给 2-4 条 - improvement_suggestions 给 2-4 条 - sample_better_answer 用中文给出一段更优表达示例 - final_summary_text 适合直接展示给用户，也可交给 TTS 朗读 """ return llm_json ...[truncated 3123 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Tainted flow: 'ASR_URL' from os.environ.get (line 89, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/run_interview.py (reported line 299)May include surrounding context.

python

data["language"] = language.replace("-CN", "").lower()
    with audio_path.open("rb") as handle:
        files = {"file": (audio_path.name, handle)}
        response = requests.post(
            ASR_URL,
            headers=headers,
            data=data,

Tainted flow: 'TTS_URL' from os.environ.get (line 95, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/run_interview.py (reported line 328)May include surrounding context.

python

"voice_setting": {"voice_id": TTS_VOICE_ID},
        "audio_setting": {"format": "mp3", "sample_rate": 32000},
    }
    response = requests.post(TTS_URL, headers=headers, json=payload, timeout=TTS_TIMEOUT)
    response.raise_for_status()
    result = response.json()
    if result.get("base_resp", {}).get("status_code") != 0:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run_interview.py (reported line 73)May include surrounding context.

python

def load_env() -> None:
    if load_dotenv is None:
        return
    for path in (SKILL_DIR / ".env", Path.cwd() / ".env"):
        if path.exists():
            load_dotenv(path)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill describes executable behavior that uses environment variables, networked LLM/ASR/TTS services, and writes outputs to disk, but it does not declare any explicit tool scope or permissions. This creates a trust and containment gap: a host may expose broader capabilities than intended, and reviewers or runtime policy engines cannot clearly enforce least privilege for a skill that handles user audio, transcripts, and generated reports.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description states the skill performs a Chinese voice interview simulation and later specifies a default language of zh-CN, while the scope explicitly excludes English interviews. This imposes a language constraint as a policy-relevant natural-language behavior without presenting it as a user choice or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The prompt explicitly constrains the interaction language to Chinese using natural-language instructions, including a fixed 语言：中文 field. This appears to enforce a specific language/locale choice rather than offering user selection or documenting a region-specific justification, which matches the policy-violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The module instructions repeatedly specify that the simulated interview and generated content must be in Chinese, reinforcing a fixed language policy across the skill. Because the file does not indicate user opt-in or a justified locale restriction, this is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example SessionConfig sets "language": "zh-CN", which natural-language-wise implies the skill operates in a fixed locale. The file does not mention any user-selectable language option or justify that the skill is intentionally region-specific, so this can conflict with language/locale choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Multiple system prompts explicitly instruct the model to act as a Chinese interviewer and produce Chinese interview content, which enforces a locale/language constraint at the skill level. Although a --language flag exists later, these prompts still hard-code Chinese behavior rather than offering a genuine user language choice.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/run_interview.py (reported line 89)May include surrounding context.

python

LLM_TIMEOUT = float(os.environ.get("INTERVIEW_LLM_TIMEOUT", "60"))
    LLM_TEMPERATURE = float(os.environ.get("INTERVIEW_LLM_TEMPERATURE", "0.3"))

    ASR_URL = os.environ.get("INTERVIEW_ASR_URL", "https://api.senseaudio.cn/v1/audio/transcriptions")
    ASR_MODEL = os.environ.get("INTERVIEW_ASR_MODEL", "sense-asr-pro")
    ASR_API_KEY = os.environ.get("INTERVIEW_ASR_API_KEY", os.environ.get("SENSEAUDIO_API_KEY", ""))
    ASR_TIMEOUT = float(os.environ.get("INTERVIEW_ASR_TIMEOUT", "300"))

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/run_interview.py (reported line 95)May include surrounding context.

python

LLM_TIMEOUT = float(os.environ.get("INTERVIEW_LLM_TIMEOUT", "60"))
    LLM_TEMPERATURE = float(os.environ.get("INTERVIEW_LLM_TEMPERATURE", "0.3"))

    ASR_URL = os.environ.get("INTERVIEW_ASR_URL", "https://api.senseaudio.cn/v1/audio/transcriptions")
    ASR_MODEL = os.environ.get("INTERVIEW_ASR_MODEL", "sense-asr-pro")
    ASR_API_KEY = os.environ.get("INTERVIEW_ASR_API_KEY", os.environ.get("SENSEAUDIO_API_KEY", ""))
    ASR_TIMEOUT = float(os.environ.get("INTERVIEW_ASR_TIMEOUT", "300"))

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/run_interview.py (reported line 328)May include surrounding context.

python

"voice_setting": {"voice_id": TTS_VOICE_ID},
        "audio_setting": {"format": "mp3", "sample_rate": 32000},
    }
    response = requests.post(TTS_URL, headers=headers, json=payload, timeout=TTS_TIMEOUT)
    response.raise_for_status()
    result = response.json()
    if result.get("base_resp", {}).get("status_code") != 0:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script sends generated interview questions and the final summary text to an external TTS service without clearly informing the user. While less sensitive than raw audio in many cases, these prompts and summaries can still expose personal context, performance assessments, and job-target information to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

When the user provides an audio file, the script uploads it to an external ASR service without an explicit consent or privacy notice at the decision point. Interview answers commonly contain personal information, employment history, and other sensitive content, so silent transmission to a third party creates a real privacy and compliance risk.

Content

No source excerpt is available for this finding.

Tainted flow: 'payload' from os.environ.get (line 321, credential/environment) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/run_interview.py (reported line 506)May include surrounding context.

python

else:
        OUTPUT_DIR.mkdir(parents=True, exist_ok=True)
        report_path = OUTPUT_DIR / "final_report.json"
    report_path.write_text(json.dumps(payload, ensure_ascii=False, indent=2), encoding="utf-8")
    print(f"完整结果已保存：{report_path}")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest sets the skill's user-facing display name entirely in Chinese ("语音面试模拟器") with no indication that users can choose another language or locale. This can conflict with language/locale policy requirements when the skill is presented to a broader audience without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency specifier for openai is unpinned (>=1.30.0), which makes builds non-reproducible and allows future releases with breaking changes or newly introduced vulnerabilities to be installed automatically. This is a real supply-chain hygiene issue, though the file alone does not show active exploitation or a known vulnerable version.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

openai>=1.30.0
requests>=2.31.0
python-dotenv>=1.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

requests>=2.31.0 is unpinned, so installations may resolve to different versions over time, including versions later found vulnerable or behaviorally incompatible. Because requests has a history of security advisories, leaving it unpinned increases uncertainty and supply-chain exposure.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

openai>=1.30.0
requests>=2.31.0
python-dotenv>=1.0.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

requests has known advisories, and because the manifest does not pin a version, there is no way to verify from this file whether the installed version is affected or patched. In this skill context, the package is commonly used for network calls, so unresolved dependency versioning could matter if vulnerable code paths are present elsewhere in the project.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

python-dotenv>=1.0.0 is also unpinned, which permits uncontrolled version drift and makes it impossible to guarantee which release is deployed. If the package later introduces or contains a vulnerable version in the allowed range, the environment could be exposed without any manifest change.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

openai>=1.30.0
requests>=2.31.0
python-dotenv>=1.0.0

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 85% confidence

Finding

python-dotenv has known advisories, and without an exact version pin the project cannot demonstrate that it avoids affected releases. This is somewhat less dangerous in the current skill description because no direct .env file manipulation is shown here, but it still represents a real supply-chain verification gap.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.