boss-resume-crawler

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:01 AM UTC
• Version: 0.1.0

Overview

The skill is a disclosed Boss Zhipin scraping tool, but it asks users to run an authenticated browser with broad CDP control and unverified install steps that deserve careful review.

Install only in an isolated environment with a dedicated temporary browser profile, avoid using a normal logged-in browser profile, verify any browser binary and dependency versions before running, close the CDP browser when done, and confirm that scraping Boss Zhipin data is permitted for your use case.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:55

Finding

Unpinned Third-Party Dependencies Create a Mutable Supply-Chain Risk

Content

View full analysis

/dev/null || echo "❌ 缺少 websocket-client → pip3 install websocket-client" ``` ```bash # 安装依赖 npm install cloakbrowser playwright-core ``` Equivalent installation instructions also appear at `README.md:39` and `README.md:44`. ### Technical Analysis The installation instructions do not constrain dependency versions or verify package integrity. Consequently, the code installed by these commands can change after the Skill has been audited. The npm installation is particularly sensitive because npm packages can execute lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Such scripts execute with the permissions of the user running npm. The Python package is also installed without a version constraint or hash verification. There is no evidence in the audited repository that the named packages are currently malicious. The vulnerability is the mutable and unverified dependency trust boundary. ### Attack Path 1. An attacker compromises the package registry account, package publication process, or a transitive dependency of one of the named packages. 2. The attacker publishes a malicious release under the same package name or introduces malicious code into a dependency selected by the unconstrained resolver. 3. A user follows the Skill instructions and runs `npm install cloakbrowser playwright-core` or `pip3 install websocket-client`. 4. The package manager retrieves the compromised version because no reviewed version or integrity hash is required. 5. Malicious npm lifecycle code or imported Python code executes with the installing user's privileges. 6. The malicious dependency can access local files and potentially interact with the authenticated browser session used by the Skill. ### ...[truncated 583 chars]

Remediation

View remediation

" npm install --save-exact "cloakbrowser@" "playwright-core@" ``` 2. Add a Python requirements file with hashes and install it using: ```bash pip3 install --require-hashes -r requirements.txt ``` 3. Commit an npm lockfile and use `npm ci` instead of unconstrained `npm install`. 4. Review transitive dependencies and npm lifecycle scripts before distribution. 5. Where lifecycle scripts are unnecessary, install with `npm ci --ignore-scripts`. 6. Document the expected package publisher, registry, version, and integrity values. 7. Run dependency installation in an isolated, non-privileged environment and never recommend `sudo`. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:70

Finding

Downloaded Browser Archive Is Executed Without Authenticity or Integrity Verification

Content

View full analysis

tar -xzf /tmp/cloakbrowser-darwin-x64.tar.gz -C ~/.cache/cloakbrowser/ # 设置环境变量 export CLOAKBROWSER_BINARY_PATH=~/.cache/cloakbrowser/Chromium.app/Contents/MacOS/Chromium ``` The downloaded application is subsequently launched: ```bash open ~/.cache/cloakbrowser/Chromium.app --args \ --remote-debugging-port=9222 \ "--remote-allow-origins=*" \ --user-data-dir=<你的浏览器数据目录> \ "" ``` Equivalent instructions appear at `README.md:47-50` and `README.md:59-63`. ### Technical Analysis The instructions download a browser archive from an unspecified URL, follow redirects with `curl -L`, extract the archive into the user's cache, and later execute the extracted application. No SHA-256 digest, cryptographic signature, trusted-host restriction, or archive-content validation is performed. This creates a direct trust chain from the selected download endpoint to local native-code execution. The use of a proxy adds another component to the delivery path, while unrestricted redirects permit the final download host to differ from the original host. The repository does not contain an actual download URL or evidence that a malicious archive is intentionally supplied. Nevertheless, following these instructions with a compromised or untrusted URL would execute an unverified payload. ### Attack Path 1. An attacker controls or compromises the browser archive URL, a redirect destination, release account, proxy, or distribution endpoint. 2. The victim follows the documented command and downloads the substituted archive to `/tmp/cloakbrowser-darwin-x64.tar.gz`. 3. Because no digest or signature is checked, the malicious arch ...[truncated 1117 chars]

Remediation

View remediation

/tmp/cloakbrowser-darwin-x64.tar.gz" | shasum -a 256 -c - ``` 4. Prefer cryptographic signature verification using a separately distributed and pinned publisher key. 5. Configure curl to fail on HTTP errors and restrict protocol use: ```bash curl --fail --show-error --location \ --proto '=https' --proto-redir '=https' \ --output /tmp/cloakbrowser-darwin-x64.tar.gz \ '' ``` 6. Validate the final redirect host against an explicit allowlist. 7. Inspect archive entries before extraction and reject absolute paths, `..` traversal entries, unexpected symbolic links, and unexpected executables. 8. Extract into a newly created directory with restrictive permissions rather than reusing a mutable cache directory. 9. Verify the application's platform code signature where supported before launch. 10. Document that verification failure must abort installation and execution. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:82

Finding

Wildcard CDP Origin Policy Exposes an Authenticated Browser to Unnecessary Control

Content

View full analysis

\ "" ``` The same configuration is repeated at `references/sop.md:137-145` and `README.md:59-63`. ### Technical Analysis Chrome DevTools Protocol grants extensive control over attached browser targets. A CDP client can navigate pages, execute JavaScript in page contexts, inspect page content, create or close tabs, and observe authenticated application data. The option `--remote-allow-origins=*` permits WebSocket upgrade requests from every origin. This exceeds the minimum privilege needed by the included Python scripts, which connect from a local process and only require access to the loopback debugging endpoint. The risk is amplified because the instructions direct the user to authenticate to Boss Zhipin in the same browser profile. If an untrusted local process or reachable web origin can access the debugging endpoint, it may gain control over the authenticated session. ### Attack Path 1. The victim starts Chromium with remote debugging on port 9222 and the wildcard origin allowance. 2. The victim authenticates to Boss Zhipin in that browser profile. 3. An attacker-controlled local process, browser-accessible origin, or other actor capable of reaching the endpoint requests `http://localhost:9222/json`. 4. The attacker obtains a target's `webSocketDebuggerUrl`. 5. The attacker establishes a CDP WebSocket connection, with the wildcard origin policy accepting its origin. 6. The attacker invokes commands such as `Runtime.evaluate`, `Page.navigate`, or target-management operations. 7. The attacker reads authenticated page content, manipulates tabs, or performs actions through the victim's active session. T ...[truncated 971 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/sop.md (reported line 156)May include surrounding context.

也可以用纯 JS 统计：

bash

curl -s http://localhost:9222/json | python3 -c "import json,sys; pages=json.load(sys.stdin); [print(p['webSocketDebuggerUrl']) for p in pages if 'jobs' in p.get('url','')]"

上限检测

Lp1

High

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The script clearly exercises network-capable behavior through WebSocket CDP control, localhost DevTools HTTP calls, and browser navigation, yet the finding indicates those capabilities are not declared. In an agent skill, undeclared network/browser-control capability is dangerous because it can access local browser sessions, scrape sensitive page data, and perform actions outside the user's expected permission model.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly promotes bulk scraping of Boss 直聘 job details, including security_id and full job descriptions, and emphasizes anti-detection techniques without warning users about privacy, contractual, or platform-risk implications. This is dangerous because it normalizes large-scale collection of potentially regulated or access-controlled data and may lead users to violate site terms, expose identifiers, or mishandle scraped data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill declares broad trigger phrases like “爬取”, “抓取”, and “JD 数据”, which can overlap with ordinary conversation and cause the crawler skill to activate when the user did not explicitly request Boss直聘 scraping. Because this skill drives browser automation and anti-detection scraping workflows, accidental activation increases the chance of unintended data collection or execution of high-risk actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The spec explicitly requires collecting full job descriptions and may also collect recruiter names/titles from detail pages, but it provides no guidance on consent, minimization, retention, or downstream handling of scraped data. In a resume/job-crawling skill, this increases privacy and compliance risk because personally identifiable or platform-restricted data may be harvested and stored at scale without safeguards.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This file presents all operational guidance exclusively in Chinese, and there is no natural-language indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file contains executable code that queries the local Chrome DevTools endpoint and enumerates browser pages, which can expose browsing context and page data. Although the SOP explains how to do it, it does not clearly warn the user about the privacy implications of connecting to an existing browser profile and inspecting page contents.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · references/sop.md (reported line 186)May include surrounding context.

import urllib.request

def open_new_tab(url): req = urllib.request.Request(f'http://localhost:9222/json/new?{url}', method='PUT') with urllib.request.urlopen(req, timeout=10) as response: return json.loads(response.read().decode('utf-8')).get('id')

text

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/boss_extract_cdp.py (reported line 50)May include surrounding context.

python

def get_list_page_ws():
    """获取列表页 WebSocket URL"""
    try:
        r = subprocess.run(
            ['curl', '-s', 'http://localhost:9222/json'],
            capture_output=True, text=True, timeout=10
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/boss_extract_cdp.py (reported line 155)May include surrounding context.

python

def get_list_page_ws():
    """获取列表页 WebSocket URL"""
    try:
        r = subprocess.run(
            ['curl', '-s', 'http://localhost:9222/json'],
            capture_output=True, text=True, timeout=10
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 87% confidence

Finding

This subprocess call builds a CDP endpoint URL using an unencoded url value and sends it to a locally exposed DevTools service that can open arbitrary tabs. While there is no shell injection, the pattern still enables unsafe browser automation against any URL if the input becomes attacker-controlled, which can drive authenticated browser state, reach internal network resources, or interact with sensitive local pages through the debugging interface.

Content

Scanner excerpt · scripts/boss_extract_cdp.py (reported line 131)May include surrounding context.

python

"""CDP 打开新 tab，返回 page_id"""
    try:
        req_url = f'http://localhost:9222/json/new?{url}'
        r = subprocess.run(
            ['curl', '-s', '-X', 'PUT', req_url],
            capture_output=True, text=True, timeout=15
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/boss_extract_cdp.py (reported line 144)May include surrounding context.

python

def close_tab(page_id):
    """关闭指定 tab"""
    try:
        subprocess.run(
            ['curl', '-s', f'http://localhost:9222/json/close/{page_id}'],
            capture_output=True, timeout=5
        )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code creates output directories and later writes scraped job records and error logs to CSV files, which affects user data storage on disk. Although output paths are printed, there is no confirmation prompt or explicit warning that the script will persist potentially sensitive scraped content locally.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/boss_extract_final.py (reported line 60)May include surrounding context.

python

def get_ws_url():
    """获取列表页 WebSocket URL"""
    result = subprocess.run(['curl', '-s', 'http://localhost:9222/json'],
                            capture_output=True, text=True, timeout=5)
    pages = json.loads(result.stdout)
    for p in pages:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/boss_extract_final.py (reported line 71)May include surrounding context.

python

def get_ws_url():
    """获取列表页 WebSocket URL"""
    result = subprocess.run(['curl', '-s', 'http://localhost:9222/json'],
                            capture_output=True, text=True, timeout=5)
    pages = json.loads(result.stdout)
    for p in pages:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/boss_extract_final.py (reported line 415)May include surrounding context.

python

def get_ws_url():
    """获取列表页 WebSocket URL"""
    result = subprocess.run(['curl', '-s', 'http://localhost:9222/json'],
                            capture_output=True, text=True, timeout=5)
    pages = json.loads(result.stdout)
    for p in pages:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/boss_extract_pure.py (reported line 109)May include surrounding context.

python

def get_ws_url():
    """获取列表页 WebSocket URL"""
    result = subprocess.run(['curl', '-s', 'http://localhost:9222/json'],
                            capture_output=True, text=True, timeout=5)
    pages = json.loads(result.stdout)
    for p in pages:

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 84% confidence

Finding

open_new_tab sends a request to the local DevTools endpoint with a URL parameter that is not validated. Even though the destination host is fixed to localhost, an attacker-controlled URL could cause the browser automation to open arbitrary internal or external targets, which is effectively a browser-mediated request primitive and expands access to resources reachable from the user's environment.

Content

Scanner excerpt · scripts/boss_extract_final.py (reported line 151)May include surrounding context.

python

"""打开新标签页"""
    try:
        import urllib.request
        req = urllib.request.Request(
            f'http://localhost:9222/json/new?{url}', method='PUT'
        )
        with urllib.request.urlopen(req, timeout=10) as response:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/boss_extract_final.py (reported line 207)May include surrounding context.

python

def extract_jobs_from_snapshot(agent_browser_path):
    """从 snapshot 提取职位数据"""
    result = subprocess.run(
        [agent_browser_path, '--cdp', '9222', 'snapshot', '-i', '--timeout', '8000'],
        capture_output=True, text=True, timeout=15
    )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/boss_extract_final.py (reported line 290)May include surrounding context.

python

def get_link_href(agent_browser_path, ref):
    """获取指定 ref 的链接"""
    result = subprocess.run(
        [agent_browser_path, '--cdp', '9222', 'get', 'attr', f'@{ref}', 'href', '--timeout', '5000'],
        capture_output=True, text=True, timeout=10
    )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/boss_extract_final.py (reported line 408)May include surrounding context.

python

continue

        detail_url = f"https://www.zhipin.com/job_detail/{job_id}.html"
        subprocess.run(
            [agent_browser, '--cdp', '9222', 'navigate', detail_url],
            capture_output=True, timeout=10
        )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script extracts detailed content from browser pages over CDP/WebSocket, including security_id and full job descriptions, and then persists that scraped data. In agent/browser contexts this is sensitive because CDP access can read authenticated page contents from a user's live session, so collecting and storing it without explicit privacy disclosure or minimization materially increases data-exposure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script writes scraped job data and error logs to disk automatically without an explicit warning, consent prompt, or clear data retention notice. This is risky because the extracted dataset includes detailed page content and identifiers that may be sensitive, and silent persistence increases the chance of unintended local exposure.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · scripts/boss_extract_pure.py (reported line 121)May include surrounding context.

python

def open_new_tab(url):
    """打开新标签页"""
    try:
        req = urllib.request.Request(
            f'http://localhost:9222/json/new?{url}', method='PUT'
        )
        with urllib.request.urlopen(req, timeout=10) as response:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/boss_extract_final.py (reported line 164)May include surrounding context.

python

def close_tab(page_id):
    """关闭标签页"""
    subprocess.run(['curl', '-s', f'http://localhost:9222/json/close/{page_id}'],
                   capture_output=True, timeout=5)

Static analysis

No suspicious patterns detected.