T08 · Insecure Dependencies
Warning
- Location
README.md:30- Finding
Unpinned Third-Party CLI Dependency with Browser Session Access
- Content
View full analysis
- Remediation
View remediation
Security audit
fk-boss-greeting
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent with Boss Zhipin job-search automation, but it uses browser login state and can send account actions with insufficient scoping and fragile install/update guidance.
Review this carefully before installing. Use a dedicated Boss Zhipin account or browser profile if possible, pin and verify the CLI dependency, avoid the `git pull` reinstall instruction unless you have reviewed the source, and require a visible candidate review before any greetings are sent or scheduled.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:25- Finding
Mutable Repository Update Is Installed Without Commit Verification
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/boss_auto_greet.sh:15- Finding
Configuration Path Mismatch Prevents Packaged Safety Rules from Loading
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/boss_auto_greet.sh:35- Finding
Configured Rate Limit and Documented Positive Job Filter Are Not Enforced
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README instructs users to run
boss login --cookie-source chromeand says it will read the existing Chrome login state, but it does not clearly warn that this accesses browser-stored authentication material for Boss直聘. In an automation skill that performs actions on the user's behalf, omission of this disclosure reduces informed consent and can lead users to grant access to sensitive session state without understanding the privacy and account-takeover implications if mishandled.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill invokes shell commands, reads local browser-derived authentication state, and records logs, but it declares no explicit tool scope or permissions boundary. That makes a powerful automation skill easier to trigger with broader-than-intended capabilities, increasing the chance of unauthorized command execution or outbound actions on the user's behalf.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation description is broad enough to match common job-seeking requests such as searching jobs, delivering resumes, or communicating with recruiters, which can cause the skill to auto-activate in situations where the user did not clearly intend automation. Because the skill performs outbound actions and account-affecting operations, overbroad triggering materially raises the risk of unintended contact or spammy behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description does not clearly warn that it uses stored Chrome login state and can send greetings or otherwise act through the user's Boss直聘 account. This is dangerous because users may not realize the skill is leveraging existing browser credentials to perform real external actions, creating consent, privacy, and account-abuse risks.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The entire skill description and example invocations are presented only in Chinese, with no indication that users may interact in another language or locale. Under the language/locale policy, a skill should not implicitly force a specific language without opt-in unless the regional restriction is clearly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The description explicitly states the rules are for Boss直聘 greeting operations, which constrains the skill to a Chinese-language/platform context. Under the policy, locale-specific constraints should either be user-selectable or clearly justified as region-specific; this file does not provide that justification or an opt-in mechanism.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The top-level docstring describes the skill entirely in Chinese, which signals a fixed language/locale choice without offering user opt-in or documenting a justified region-specific constraint. The policy requires flagging language or locale restrictions when the skill does not provide a choice.
- Content