Security audit

UP 简历求职助手

Security checks for vulnerabilities and agentic risk

Overview

Clawjob is a coherent resume and job-search assistant, but it needs Review because installation and monitoring workflows grant more ongoing local and third-party authority than is safely scoped.

Install only if you are comfortable sending resume and job-search data to UPCV and running its MCP server locally. Avoid enabling the daily monitor unless you inspect the generated script and scheduler entry, pin or verify the MCP package version, and replace broad cleanup commands with targeted removal of only the Clawjob entry.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Note

Location: resume-edit/SKILL.md:153
Finding: Mandatory promotional content alters task output
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:23
Finding: Unpinned package execution through npx creates supply-chain exposure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: job-monitor/SKILL.md:66
Finding: User-controlled monitoring criteria can be interpolated into a scheduled shell command
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: job-monitor/SKILL.md:147
Finding: Documented crontab removal command can delete unrelated scheduled jobs
Content: View full analysis
Remediation: View remediation
"$HOME/.jobsclaw/crontab.backup" ``` 5. Show the exact entry that will be removed and require user confirmation. 6. Use a dedicated management script that verifies the marker and refuses to modify unrelated lines. 7. Retain the targeted `crontab -e` guidance and make it consistent throughout the file. 8. For launchd, unload and remove only `com.jobsclaw.monitor.plist`; do not affect unrelated LaunchAgents. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (42)

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 97% confidence
Finding: The generated script invokes claude -p non-interactively to perform future autonomous actions using an external model/provider. This delegates later behavior to another model at execution time, outside the original review context, and can enable unbounded prompt-driven actions or data handling each time the scheduled task runs.
Content: Scanner excerpt · job-monitor/SKILL.md (reported line 71)May include surrounding context.
md
REPORT_FILE="$REPORT_DIR/$TODAY.md" # 使用 Claude Code 执行查询并生成简报 claude -p " 使用 UPCV MCP Server 执行以下查询并生成 Markdown 简报： 1. 调用 campus.recommend（freshOnly: true）获取 24h 内新发布的校招项目

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly collects highly sensitive personal data such as name, phone number, email, city, and personal website, then transmits it through MCP tools, but provides no explicit privacy notice, consent checkpoint, retention statement, or data-handling warning. In a resume workflow this is especially sensitive because it combines identity and career information, increasing risk of privacy violations, unintended disclosure, and downstream misuse if tools, logs, or third-party services are compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README states that actions in the AI assistant are seamlessly connected to the UP 简历 web platform and later describes real-time resume synchronization, but it does not provide a clear warning about what user data is transmitted, stored, and shared across systems. Because resumes and job-search workflows commonly contain highly sensitive personal information, missing disclosure and consent language can lead users to unknowingly expose PII to external services.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill advertises broad trigger phrases such as '找工作' and similar everyday language, which can cause unintended invocation during normal conversation. In this skill’s context, accidental activation is more dangerous because the skill can search jobs, edit resumes, prepare applications, and synchronize data to an external service, potentially exposing personal data or causing unwanted actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The README instructs users to run an MCP server via npx @upcv/mcp-server without pinning an exact package version. This causes installs to resolve to the latest published package at execution time, increasing supply-chain risk if a malicious or compromised update is released, especially because MCP servers typically receive sensitive resume and job-application data and may execute with local user privileges.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The top-level trigger phrases include very broad terms such as '找工作' and similar common-language prompts, which can cause the skill to activate in conversations where the user did not clearly request this tool. Over-broad auto-invocation is risky here because the skill can access resume data, search external services, and lead into persistent system changes such as monitoring setup.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill instructs users to install and execute an MCP server via npx @upcv/mcp-server without pinning an exact package version. Because npx fetches the latest published package at runtime, a compromised maintainer account, malicious update, or dependency hijack could cause arbitrary code execution on the user's machine when following the setup steps.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Several listed triggers remain ambiguous, including phrases for editing resumes, searching jobs, and monitoring recommendations, without clear guardrails on when the skill should or should not activate. In context, unintended invocation could expose personal resume information to the MCP service or initiate workflows the user did not mean to start.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to create monitor.sh and install launchd or cron scheduled tasks, which are persistent system modifications, but it does not clearly require an upfront warning and explicit consent for those changes. This is dangerous because a user may trigger ongoing background execution and file creation on their machine without understanding the persistence, frequency, or cleanup implications.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases include very broad job-seeking terms like '投递', '申请岗位', and '填写申请', which can cause the skill to activate in situations the user did not intend. Because this skill handles resumes, links, and application workflows, unintended activation could expose personal data inappropriately or push users into using external tooling without clear consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: All user-facing instructions, examples, and invocation guidance are written exclusively in Chinese, and the skill does not state that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill instructs users to install and run an MCP server via npx @upcv/mcp-server without pinning an exact version. This creates a supply-chain risk: future package updates, compromised maintainer accounts, or malicious dependency changes could execute unreviewed code in the user's environment when the skill is set up.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrases are broad enough that normal conversation about internships or campus recruiting could activate this skill unexpectedly. Misrouting user intent can cause unintended external searches and disclosure of user preferences or query content to the MCP backend, especially in an agent that auto-selects skills based on natural language.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill instructs users to install an MCP server via npx @upcv/mcp-server without pinning a specific version. This creates a supply-chain risk: future package updates or a compromised upstream release could change the code executed at install/runtime, leading to unexpected behavior or malicious code execution in the agent environment.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill metadata frames the feature as monitoring and daily brief generation, but the body directs modification of the user's environment by writing scripts, reports, and scheduler configuration files. This mismatch undermines informed consent and can cause users or higher-level agents to invoke a skill that performs more invasive actions than its description implies.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases include broad natural-language requests such as '设置提醒' and '每日推荐', which can match common conversation and cause the skill to activate unexpectedly. Because the skill performs state-changing actions, accidental invocation raises the chance of unreviewed file writes or persistence setup.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The skill instructs users to install an MCP server via an unpinned npx @upcv/mcp-server, which fetches the latest package version at runtime. That creates a supply-chain risk: a compromised upstream release or unexpected breaking change could alter behavior or execute unintended code on the user's machine.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill goes beyond passive job monitoring and directs the agent to create a shell script plus OS-level scheduled tasks. This expands the skill from data retrieval into persistence and local system modification, increasing the risk of unintended execution, abuse of agent privileges, and user surprise about ongoing automated actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs creation of report files and recurring scheduled jobs without a prominent warning that this will persist on disk and continue running automatically. Lack of explicit disclosure increases the risk of silent data retention, repeated external queries, and user confusion about what the agent changed locally.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 93% confidence
Finding: The script creates a hidden directory under the user's home directory and stores dated reports there, establishing ongoing local state for the monitoring workflow. Persistent local storage is risky in this context because it is created by the agent and may contain sensitive job-search preferences or links without explicit retention controls.
Content: Scanner excerpt · job-monitor/SKILL.md (reported line 66)May include surrounding context.
md
# 监控条件：[用户设置的条件] REPORT_DIR="$HOME/.jobsclaw/reports" mkdir -p "$REPORT_DIR" TODAY=$(date +%Y-%m-%d) REPORT_FILE="$REPORT_DIR/$TODAY.md"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 93% confidence
Finding: The script creates a hidden directory under the user's home directory and stores dated reports there, establishing ongoing local state for the monitoring workflow. Persistent local storage is risky in this context because it is created by the agent and may contain sensitive job-search preferences or links without explicit retention controls.
Content: Scanner excerpt · job-monitor/SKILL.md (reported line 66)May include surrounding context.
md
# 监控条件:[用户设置的条件] REPORT_DIR="$HOME/.jobsclaw/reports" mkdir -p "$REPORT_DIR" TODAY=$(date +%Y-%m-%d) REPORT_FILE="$REPORT_DIR/$TODAY.md"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 94% confidence
Finding: This line introduces creation of a LaunchAgent plist, which is a standard macOS persistence mechanism. In a skill whose core purpose is job monitoring, instructing the agent to create OS startup/scheduled configuration materially increases security risk by enabling unattended recurring execution.
Content: Scanner excerpt · job-monitor/SKILL.md (reported line 104)May include surrounding context.
macOS（launchd）：

创建 ~/Library/LaunchAgents/com.jobsclaw.monitor.plist：

xml
<?xml version="1.0" encoding="UTF-8"?>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · job-monitor/SKILL.md (reported line 108)May include surrounding context.
xml
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · job-monitor/SKILL.md (reported line 109)May include surrounding context.
xml
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · job-monitor/SKILL.md (reported line 130)May include surrounding context.
xml
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key>

Static analysis

No suspicious patterns detected.