Back to skill

Security audit

UP 简历 - 让 Agent 帮你写简历找工作

Security checks for vulnerabilities and agentic risk

Overview

This job-search skill is mostly purpose-aligned, but its daily monitoring feature creates persistent scheduled agent execution with unsafe shell-script generation.

Review the daily monitoring feature carefully before installing. Prefer one-time searches unless you intentionally want a local scheduled task, inspect any generated script before it runs, avoid putting secrets on the command line, and consider pinning the MCP package version before setup.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T06 · System Persistence

Error
Location
job-monitor/SKILL.md:103
Finding

Persistent Daily Agent Execution Through launchd or Cron

Content
View full analysis
Label com.jobsclaw.monitor ProgramArguments /bin/bash MONITOR_SCRIPT_PATH StartCalendarInterval Hour 9 Minute 0 StandardOutPath /tmp/jobsclaw-monitor.log StandardErrorPath /tmp/jobsclaw-monitor.err ``` ```bash launchctl load ~/Library/LaunchAgents/com.jobsclaw.monitor.plist ``` ```bash crontab -e # Add: run every day at 9:00 0 9 * * * /bin/bash MONITOR_SCRIPT_PATH ``` ### Technical Analysis The Skill instructs the Agent to create a shell script and register it as either a macOS LaunchAgent or a Linux cron job. This causes the script—and, indirectly, `claude -p` and the external UPCV MCP service—to execute across sessions without requiring the user to start another interactive Skill run. Scheduled execution is relevant to the declared daily-monitoring feature, but invoking a general-purpose AI Agent on a recurring basis is broader than the minimum privilege needed to perform a fixed job query. The referenced script remains mutable after scheduler registration, so any later modification to that script changes the behavior of every future scheduled execution. The workflow describes teardown commands, but it does not require an explicit approval step immediately before writing and loading the persistent scheduler configuration. It also d ...[truncated 1354 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
job-monitor/SKILL.md:59
Finding

Shell Command Injection Through Generated Monitoring Conditions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
README.md:23
Finding

Mutable Third-Party MCP Package Executed Through Unpinned npx Command

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
resume-create/SKILL.md:177
Finding

Skill Workflow Forces Unrelated Marketplace Promotion Into Agent Responses

Content
View full analysis
If you find it useful, please like it in the Skills Marketplace and share it with friends who are looking for jobs! ``` The same behavior is reinforced in example completion messages: ```markdown If you find it useful, please like it in the Skills Marketplace and share it with more students looking for jobs! ``` ### Technical Analysis The Skill instructs the Agent to append a request for marketplace engagement and social sharing to task-completion responses. This content is not necessary to create, edit, search, monitor, or export a resume. Because it is included in workflow instructions and examples across the package, loading and following the Skill predictably modifies user-facing output for the publisher's promotional benefit. This is instruction-level output hijacking rather than code execution. It does not override an explicit safety control, but it changes the Agent's response goals by introducing advertising that is unrelated to the user's requested operation. ### Attack Path 1. The Agent loads one of the affected Skill instruction files. 2. The user requests a normal resume or job-search operation. 3. The Agent follows the Skill's completion workflow. 4. The workflow causes the Agent to append marketplace promotion and a request to share the product. 5. The user's response is ...[truncated 567 chars]
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (41)

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
98% confidence
Finding

The script explicitly selects and invokes the external claude CLI as part of unattended execution. This hands control of recurring local actions to an external model/provider path that may have broad capabilities and changing behavior, increasing the risk of unexpected actions, prompt injection propagation, or sensitive local context being processed outside the declared tool boundary.

Content

Scanner excerpt · job-monitor/SKILL.md (reported line 71)May include surrounding context.

md
REPORT_FILE="$REPORT_DIR/$TODAY.md"

# 使用 Claude Code 执行查询并生成简报
claude -p "
使用 UPCV MCP Server 执行以下查询并生成 Markdown 简报:

1. 调用 campus.recommend(freshOnly: true)获取 24h 内新发布的校招项目

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Several trigger phrases are broad everyday job-seeking terms such as '找工作' and '投递', which can cause the skill to activate in situations where the user did not intend to invoke this integration. In a skill that can search jobs, monitor activity, sync resume data, and guide applications, unintended invocation can expose personal data to external services or trigger account-affecting actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The README instructs users to run an unpinned MCP server package via npx, which fetches the latest published version at execution time. This creates a supply-chain risk: a malicious or compromised package update could be executed by users without review, and MCP servers typically receive access to sensitive local context and agent interactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README advertises real-time resume synchronization between the AI assistant and the UP 简历 web service, as well as daily monitoring behavior, but does not prominently warn users about privacy implications, data sharing, persistence, or account-side effects. Because resumes and job-search data are highly sensitive personal information, omission of clear consent and impact warnings can lead to unintended disclosure or continuous processing of user data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill metadata includes broad trigger phrases such as creating/editing resumes, finding jobs, and monitoring campus recruiting, which are common user intents and can cause the skill to activate unexpectedly. Unintended activation matters here because the skill can access external MCP tools, manipulate resume data, and guide monitoring/task creation, increasing the chance of surprising actions or data disclosure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The installation command uses npx @upcv/mcp-server without pinning an exact version, so future installs may fetch a different package version than the author reviewed. This creates a supply-chain risk: a compromised upstream release or breaking behavioral change could be introduced into users' environments at install time.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The listed trigger phrases are ambiguous and overlap with normal conversation, such as '找工作', '社招', and '每日推荐', making accidental invocation more likely. In this skill's context, accidental activation is more dangerous because it can lead to resume modifications, job searches against external services, or setup flows that culminate in local scheduled tasks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The monitoring workflow explicitly instructs creating monitor.sh and configuring launchd/cron, which changes the local system's persistent scheduled execution state. Without a clear up-front warning and explicit consent boundary, users may unknowingly authorize persistence, recurring network activity, and local file creation under their home directory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description is written entirely in Chinese and defines the skill's invocation phrases only in Chinese, which implies a fixed language/locale requirement. There is no indication that users may interact in another language or opt into Chinese, so this appears to violate the language/locale choice policy.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to install and run an MCP server via npx @upcv/mcp-server without pinning a specific version. This creates a supply-chain risk: future package updates, compromise of the package account, or malicious dependency changes could cause users to execute unreviewed code with access to resume data, API keys, and local MCP-integrated context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation examples include broad phrases like '找校招' and '有什么校招', which can cause the skill to trigger on ordinary conversation without clear user intent to invoke this specific tool flow. Over-broad activation increases the chance of unintended tool use, unnecessary data exposure to external services, or workflow hijacking away from the user's actual request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The entire skill description, examples, and invocation phrases are written only in Chinese, with no indication that users may choose another language. This can create a locale/language policy issue if the skill implicitly constrains usage to Chinese without documenting opt-in or offering a language choice.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The skill instructs users to install an MCP server via npx @upcv/mcp-server without pinning a specific version. This creates a supply-chain risk because future or compromised package releases could be fetched and executed implicitly, especially since MCP servers typically run with local tool access and may handle sensitive job-search or resume data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are broad enough that ordinary requests such as '每日推荐' or '设置提醒' could activate a skill that writes files and installs scheduled tasks. Because this skill has side effects beyond simple chat assistance, overbroad activation increases the chance of unintended persistence or automation being proposed in the wrong context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description presents the skill as a monitoring helper but does not clearly warn that it will create local files and persistent scheduled tasks. That omission undermines informed consent and makes the capability more dangerous because users may invoke it expecting a one-time query rather than system changes.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill instructs users to install an MCP server via npx @upcv/mcp-server without pinning a specific version. This creates a supply-chain risk because future executions may fetch a modified or compromised package, and the skill is explicitly designed to support persistent automation, increasing exposure over time.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This skill directs the agent to create local scripts and scheduled tasks that persist beyond the current user session. Even if intended for convenience, that materially expands the agent's authority from answering job-monitoring queries into establishing durable automation on the host system.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

Creating ~/.jobsclaw/reports and dated report files introduces persistent local state tied to an automated workflow. On its own this is mild, but in this skill it is part of a broader unattended monitoring system, so the file persistence contributes to lasting side effects users may not expect from a search assistant.

Content

Scanner excerpt · job-monitor/SKILL.md (reported line 66)May include surrounding context.

md
# 监控条件:[用户设置的条件]

REPORT_DIR="$HOME/.jobsclaw/reports"
mkdir -p "$REPORT_DIR"
TODAY=$(date +%Y-%m-%d)
REPORT_FILE="$REPORT_DIR/$TODAY.md"

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

Creating ~/.jobsclaw/reports and dated report files introduces persistent local state tied to an automated workflow. On its own this is mild, but in this skill it is part of a broader unattended monitoring system, so the file persistence contributes to lasting side effects users may not expect from a search assistant.

Content

Scanner excerpt · job-monitor/SKILL.md (reported line 66)May include surrounding context.

md
# 监控条件:[用户设置的条件]

REPORT_DIR="$HOME/.jobsclaw/reports"
mkdir -p "$REPORT_DIR"
TODAY=$(date +%Y-%m-%d)
REPORT_FILE="$REPORT_DIR/$TODAY.md"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The generated monitor.sh delegates future work to the claude CLI, causing recursive agent-driven execution outside the original interaction boundary. This is dangerous because the scheduled task can repeatedly invoke a powerful general-purpose model with file-writing capability, creating an automation chain that is broader than the stated MCP-only monitoring purpose.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

The skill instructs creation of a LaunchAgent plist, which is a standard macOS persistence mechanism. Embedding this in a job-monitor skill increases risk because it normalizes OS-level persistence for a task that could be handled interactively or by user-owned automation.

Content

Scanner excerpt · job-monitor/SKILL.md (reported line 104)May include surrounding context.

macOS(launchd):

创建 ~/Library/LaunchAgents/com.jobsclaw.monitor.plist:

xml
<?xml version="1.0" encoding="UTF-8"?>

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

This duplicate detection still points to the same LaunchAgent persistence configuration. The security issue is the same: the skill instructs users to install a durable OS-level scheduled task for future execution.

Content

Scanner excerpt · job-monitor/SKILL.md (reported line 108)May include surrounding context.

xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

This duplicate detection still points to the same LaunchAgent persistence configuration. The security issue is the same: the skill instructs users to install a durable OS-level scheduled task for future execution.

Content

Scanner excerpt · job-monitor/SKILL.md (reported line 108)May include surrounding context.

xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

The LaunchAgent label declaration is part of a named persistent service on macOS. Naming and installing a service formalizes recurring execution and makes this more than a transient assistant action, increasing operational and security risk if behavior later changes.

Content

Scanner excerpt · job-monitor/SKILL.md (reported line 109)May include surrounding context.

xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.jobsclaw.monitor</string>

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · job-monitor/SKILL.md (reported line 130)May include surrounding context.

StandardErrorPath /tmp/jobsclaw-monitor.err

text

加载任务:

Static analysis

No suspicious patterns detected.