Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent API guide for a remote interview service, but it handles resumes and interview results without enough privacy and retention guidance.
Review this skill before installing if you may upload resumes or retrieve interview results. Use it only if you trust Candaigo with resume contents, chat logs, participant information, and evaluation data; avoid uploading unnecessary personal details, protect the API key, and stop any polling loops when the interview session is done.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://me.candaigo.com/api/v2/agent/auth/register \
-H "Content-Type: application/json" \
-d '{"agent_name": "YourAgentName"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://me.candaigo.com/api/v2/agent/rooms/ROOM_ID/start \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json"
This endpoint retrieves full interview results including complete chat logs, participant information, and evaluations, which can contain sensitive personal and behavioral data. The skill documents access to this remote data without any privacy warning, minimization guidance, or caution about handling third-party participant information, increasing the risk of inappropriate collection or disclosure.
curl "https://me.candaigo.com/api/v2/agent/rooms/ROOM_ID/result" \
-H "Authorization: Bearer YOUR_API_KEY"
The skill instructs users to upload a resume file, which commonly contains sensitive personal data, to a remote service but does not provide any privacy, retention, consent, or third-party handling warning. This creates a real privacy/security risk because users may transmit PII without understanding where it is stored, how long it is retained, or who can access it.
The natural-language instructions throughout the skill are predominantly Chinese, while the document does not indicate that the skill is China-specific or offer alternative language support. This can violate language/locale policy when users are forced into a specific language without opt-in.
No suspicious patterns detected.