AI-Interview-Coach

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:21 AM UTC
• Version: 5.0.0

Overview

This interview-coaching skill is purpose-aligned and disclosed, but users should be aware it can read provided resumes and store local practice history.

Install only if you are comfortable with an interview coach reading resumes you explicitly provide and keeping local practice history. Prefer redacting unnecessary personal details from resumes, check or delete ~/.ai-interview-coach/history.json when needed, and consider using a pinned/manual install path instead of the unpinned npx command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:19

Finding

Unpinned Third-Party Package Execution During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 19 and 205
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

Vulnerable Code

The following installation command appears at both identified locations:

bash

npx skills add HogoZhang/ai-interview-coach

Technical Analysis

The documented installation procedure invokes npx without pinning the skills package to a reviewed version or verifying its integrity. If the package is not already available locally, npx may retrieve it from the configured npm registry and execute its current published version.

Consequently, the code executed during installation is not immutable and may differ from the code present when this project was audited. A compromised maintainer account, malicious package update, registry compromise, or dependency takeover could replace the resolved package with attacker-controlled code.

The repository also documents a manual installation method, but the unsafe npx command is presented as the recommended one-click installation method.

Attack Path

1. An attacker compromises the publishing account, package, registry path, or upstream dependency associated with the unpinned skills package.
2. The attacker publishes a malicious version containing install-time or runtime code.
3. A user follows the recommended command:

   bash

   npx skills add HogoZhang/ai-interview-coach
   

4. npx resolves and downloads the attacker-controlled package version.
5. The package executes with the privileges of the user running the command.
6. The malicious package can access or modify resources available to that user.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. The accessible scope may include:

• Reading or modifying user-accessible files.
• Accessing environment variables and credentials available to the process.

...[truncated 457 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer to a specifically audited version instead of resolving the latest release:

   bash

   npx skills@<reviewed-version> add HogoZhang/ai-interview-coach
   

2. Pin the installed Skill to an immutable commit or release identifier where supported.
3. Publish and verify package integrity hashes or signed release provenance.
4. Document the expected npm registry and advise users to verify that their registry configuration has not been redirected.
5. Prefer the documented manual installation procedure when a trustworthy pinned installer cannot be provided.
6. Audit the pinned installer package and its transitive dependencies before recommending it.
7. Apply the same corrected command to both occurrences in README.md, including line 205.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 798)May include surrounding context.

md

For detailed examples, see [examples.md](examples.md).

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README states that practice history is automatically saved and used for trend analysis, but it provides no privacy notice, retention period, storage location, or opt-out mechanism. This is dangerous because interview answers, feedback, and progress history may contain sensitive personal or employment-related information, and users are not informed how long that data persists or who can access it.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are broad and overlap with normal user requests such as interview practice, history, and answer rewriting. In agentic environments, overly generic triggers can cause the skill to activate unexpectedly, influencing unrelated conversations or causing unintended access to skill behaviors and stored context. The risk is elevated because this skill also advertises history tracking and resume handling, so accidental invocation could expose or process more personal data than the user intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README encourages uploading resumes in several file formats but does not warn users that resumes commonly contain sensitive personal data such as phone numbers, email addresses, work history, and education details. Without a privacy warning or minimization guidance, users may disclose more personal information than necessary and may not understand how that data will be processed or retained.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list includes broad phrases such as '进步', '历史记录', and 'interview practice', which can cause the skill to activate in conversations that are not actually requesting interview coaching. Unintended invocation can expose unrelated user content to resume-analysis, mock-interview, or history-tracking flows, increasing privacy and confusion risk even without malicious intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs reading resume files and later describes local persistence of interview history, but it does not clearly warn users that resumes may contain sensitive personal data and that session artifacts may be stored. Because resumes commonly contain names, contact details, employment history, and education data, silent processing and retention creates a meaningful privacy and consent risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill specifies persistent storage of detailed interview session records, including scores, weaknesses, strengths, timestamps, and file paths, in a local history file. Long-term accumulation of sensitive behavioral and career-related data can reveal personal profile information and creates a larger impact if the host is shared, compromised, or if users were not aware retention was occurring.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Throughout the document, the skill’s examples, commands, generated outputs, and interaction patterns are predominantly in Chinese, including recommended trigger phrases and system responses. There is no indication that users may choose another language or that the Chinese-only behavior is a documented locale-specific constraint, which can violate language choice policy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The examples instruct the skill to read resume files and maintain interview history, but they do not disclose data handling limits, retention, or consent requirements. Because resumes and interview records commonly contain personal and employment data, silent ingestion and persistence create privacy and compliance risks if users are not clearly informed and given control.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill defines very broad trigger phrases such as common conversational commands for starting, adjusting, or continuing an interview flow. In a host environment that routes by phrase matching, these generic patterns can cause accidental invocation or context switching during unrelated conversations, leading the assistant to perform actions the user did not clearly intend.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

History and recommendation commands are triggered by very common phrases like viewing history or asking what to practice today. If the platform uses loose routing, normal conversation could unintentionally expose stored interview history, progress metrics, or recommendations without a clear privacy boundary or explicit user confirmation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README presents the skill's instructions, examples, and onboarding entirely in Chinese, which can amount to a language/locale constraint for users who have not opted into that language. The document does not state that the skill is Chinese-only, region-specific, or that alternative language use is supported.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.