筛选沟通简历

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:27 PM UTC
• Version:
  1.0.0

Overview

This recruiting skill is purpose-aligned and disclosed, but users should treat the candidate details it sends to DingTalk as personal data.

Install only if you are authorized to review these BOSS直聘 candidate records and send them through DingTalk. Verify the DingTalk recipient or channel before use, share only the fields needed for recruiting, and follow your organization’s privacy and hiring-data handling rules.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs sending candidate details to a DingTalk account, but it provides no privacy notice, consent check, minimization guidance, or verification that the recipient is authorized to receive personal data. Because the data includes education, work history, salary expectations, and name, this creates a real risk of unauthorized disclosure of personal information during normal use.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill directs the collection and transmission of identifiable candidate information in plain language to an external messaging platform, without safeguards such as consent, access control validation, or data minimization. In context, this is more dangerous because the skill is specifically designed to process recruiting communications, where personal and employment-related data is expected and could be mishandled at scale.

VirusTotal

65/65 vendors flagged this skill as clean.