boss-resume-crawler

• Outcome: Review
• Latest audit: Aug 18, 2026 · 11:01 AM UTC
• Version: 0.1.0

Overview

This skill openly does what it claims, but it automates logged-in scraping with anti-detection browser control and durable exports, so users should review the risks before installing.

Install or use this only if you are authorized to collect the target Boss直聘 data and accept possible terms-of-service, account, legal, and privacy risk. Use a dedicated temporary browser profile, keep unrelated tabs closed, shut down the debugging browser after use, choose a controlled output directory, and delete CSV/error-log files when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (15)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""CDP 打开新 tab，返回 page_id"""
    try:
        req_url = f'http://localhost:9222/json/new?{url}'
        r = subprocess.run(
            ['curl', '-s', '-X', 'PUT', req_url],
            capture_output=True, text=True, timeout=15
        )

• Confidence: 86% confidence
• Finding: This call constructs a CDP management URL by concatenating an unencoded URL into http://localhost:9222/json/new?{url}. Although subprocess is called safely without a shell, an attacker controlling job_id or the target URL could inject query/control characters and cause unintended requests to the locally exposed Chrome DevTools interface, which can open arbitrary pages and broaden browser automation scope.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def close_tab(page_id):
    """关闭指定 tab"""
    try:
        subprocess.run(
            ['curl', '-s', f'http://localhost:9222/json/close/{page_id}'],
            capture_output=True, timeout=5
        )

• Confidence: 78% confidence
• Finding: This call issues a state-changing request to the local DevTools endpoint using a page_id that is not validated. While not shell-injectable, if page_id is ever influenced by malformed or hostile CDP data, the script may close unintended browser tabs or interfere with other browser sessions exposed on localhost:9222.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

continue

        detail_url = f"https://www.zhipin.com/job_detail/{job_id}.html"
        subprocess.run(
            [agent_browser, '--cdp', '9222', 'navigate', detail_url],
            capture_output=True, timeout=10
        )

• Confidence: 84% confidence
• Finding: This launches agent-browser to navigate to a URL constructed from scraped job_id data. Although there is no shell injection, the script trusts unvalidated remote-derived identifiers to drive browser navigation through a privileged local CDP/automation context, which can trigger unintended requests or navigation to attacker-influenced destinations if parsing assumptions fail or the source data is manipulated.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares powerful tools in frontmatter and clearly instructs use of shell, network access, file reads, and file writes, yet provides no explicit permission model or user-consent guardrails for those sensitive actions. In context, this is more dangerous because the skill automates large-scale scraping, local persistence, and browser/CDP interaction, which can access authenticated sessions and write potentially sensitive job or account-derived data to disk.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The SOP explicitly instructs launching Chromium with `--remote-allow-origins=*`, which broadly relaxes origin checks for the DevTools remote debugging interface. In the context of an authenticated BOSS session and subsequent CDP automation, this unnecessarily increases exposure of the browser control plane and can enable unauthorized interaction with open tabs and session-backed data if another local process or webpage can reach the debugging endpoint.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README explicitly promotes scraping Boss直聘 while describing techniques to evade anti-bot detection, reduce detection risk, and handle account-risk blocks, but it omits clear warnings about legal, contractual, privacy, and account-suspension consequences. In the context of an agent skill, this increases the chance that users or automated systems will deploy the tool for unauthorized collection against a third-party platform without informed consent or safeguards.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The read_when conditions include broad keywords such as “爬取”, “抓取”, and “JD 数据”, which can match ordinary discussion and cause unintended activation. In this skill's context, accidental triggering is risky because the follow-on behavior includes shell commands, network scraping, CDP attachment to a live browser, and file writes, increasing the chance of unapproved sensitive actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly stores scraped results and error logs to local CSV files but does not clearly warn the user that collected data and failure details will be persisted on disk. This is more dangerous here because the output may include authenticated-session-derived identifiers, job descriptions, URLs, and troubleshooting details that can expose browsing activity or retained third-party data beyond the immediate session.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The description states broad scraping capabilities but provides no trigger scope, authorization boundary, or activation constraints. In an agent setting, this can cause the skill to be invoked too broadly for data-collection tasks, increasing the risk of unauthorized scraping, excessive collection of job data, and use in contexts the operator did not intend.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions tell the user to expose Chrome DevTools Protocol on `localhost:9222` and then automate tab enumeration, JavaScript execution, opening tabs, and reading page content, but they do not warn that any process with local access may inspect or manipulate browser tabs, cookies, and authenticated sessions. Because this skill relies on a logged-in recruitment site session, the lack of explicit warning and isolation guidance materially raises the risk of session compromise and unintended access to personal browsing data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script persists scraped job descriptions, job_id, and security_id values to CSV files on disk without any consent prompt, minimization, retention control, or warning that potentially sensitive scraped data will be stored. In a data-collection skill, this materially increases privacy, compliance, and accidental disclosure risk because the collected dataset is durable and easily exfiltrated or reused.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script persistently stores scraped job details, `job_id`, `security_id`, and full job descriptions into CSV files without consent controls, data minimization, masking, or retention safeguards. In the context of a batch crawler targeting a third-party hiring platform, this increases privacy, compliance, and misuse risk because collected identifiers can be reused for tracking, correlation, or downstream unauthorized automation.

Unvalidated Output Injection

High

• Category: Output Handling

Content

"""CDP 打开新 tab，返回 page_id"""
    try:
        req_url = f'http://localhost:9222/json/new?{url}'
        r = subprocess.run(
            ['curl', '-s', '-X', 'PUT', req_url],
            capture_output=True, text=True, timeout=15
        )

• Confidence: 88% confidence
• Finding: This is the strongest true positive in the file: the script sends a dynamically constructed URL to the Chrome DevTools /json/new endpoint without encoding or strict validation. In this skill's context, the code is explicitly designed for stealthy browser automation and anti-detection scraping, so misuse of the debugging interface is more dangerous because it can drive a privileged local browser to arbitrary destinations under attacker influence.

Unvalidated Output Injection

High

• Category: Output Handling

Content

def close_tab(page_id):
    """关闭指定 tab"""
    try:
        subprocess.run(
            ['curl', '-s', f'http://localhost:9222/json/close/{page_id}'],
            capture_output=True, timeout=5
        )

• Confidence: 80% confidence
• Finding: The script trusts page_id from the DevTools API and uses it in a follow-on control request without validation. If the local CDP service is spoofed or interfered with, this could be abused to manipulate the wrong tab set or disrupt other browser activity, though the impact is limited compared with arbitrary code execution.

Unvalidated Output Injection

High

• Category: Output Handling

Content

continue

        detail_url = f"https://www.zhipin.com/job_detail/{job_id}.html"
        subprocess.run(
            [agent_browser, '--cdp', '9222', 'navigate', detail_url],
            capture_output=True, timeout=10
        )

• Confidence: 86% confidence
• Finding: Untrusted, scraped data is transformed into a navigation target for a browser automation tool connected to a local CDP instance. In this skill's context, that is more dangerous because the script is explicitly a mass crawler operating on remote content; a manipulated href/job_id could steer automation into attacker-controlled pages or internal resources, causing SSRF-like browser requests, data exposure in the automated session, or collection of unintended content.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.