T09 · Insecure Skill Coding Practices
Error
- Location
scripts/base.py:38- Finding
Bearer Token Disclosure Through an Unrestricted API Origin
- Content
View full analysis
- Remediation
View remediation
Security audit
Jobclaw Recruit
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its recruiter purpose, but it exposes recruiter authentication tokens and sensitive hiring data in ways users should review before installing.
Install only if you are comfortable with this skill storing a recruiter token locally and sending job and candidate data to JobClaw. Avoid using custom apiUrl values, treat command output as sensitive because it can include tokens, and rotate/revoke any token that appears in logs or transcripts.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/publish_job.py:22- Finding
Authentication Token Exposure Through Standard Output and Weak File Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill description omits materially sensitive behaviors such as updating/deleting jobs and returning authentication tokens in output, while claiming other capabilities that are not actually implemented. This mismatch can mislead operators into invoking a skill with broader side effects or cause sensitive token handling to be overlooked.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill description omits materially sensitive behaviors such as updating/deleting jobs and returning authentication tokens in output, while claiming other capabilities that are not actually implemented. This mismatch can mislead operators into invoking a skill with broader side effects or cause sensitive token handling to be overlooked.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md #### Output Format Guidelines **IMPORTANT: Always respond in the user's language.** If the user communicates in Chinese, respond in Chinese. If in English, respond in English. Adapt all section headers, labels, and content to match the user's language. **Structure your analysis report as follows:**
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill invokes local scripts, reads/writes data such as saved tokens or job IDs, and communicates with a remote API, but it declares no explicit tool scope or permissions. That makes the effective capabilities opaque to reviewers and increases the risk of unintended file or network access being granted implicitly.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad enough to match ordinary conversations about hiring, recruiting, or advertising openings, which can cause the skill to activate unexpectedly. In this skill, accidental activation is more dangerous because it supports state-changing operations and candidate-data retrieval against an external system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to retrieve and analyze matched candidates, including resume details, experience, and compensation, without any privacy warning, authorization check, or data-minimization guidance. Because this involves sensitive personal and employment data, the lack of guardrails raises the risk of inappropriate disclosure, over-sharing, and noncompliant processing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script persists an authentication token to a local .token file without setting restrictive file permissions, encrypting the token, or informing the user that a bearer credential is being stored. If another local user, process, backup system, or compromised workspace can read that file, the token can be reused to impersonate the recruiter account and perform authenticated API actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The function adds an Authorization bearer token and sends HTTP requests to a remote API, potentially transmitting user or system data over the network. While network access is described in code comments/docstrings, there is no user-facing disclosure, confirmation, or warning that authentication data and request payloads are sent to an external service.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a skill focused on posting or publishing jobs, while this file's module docstring and action table implement additional operations: updating postings, soft-deleting postings, and retrieving candidate matches. Those extra capabilities go beyond the manifest's stated user intents and change the effective scope of the skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script appends the authentication token to API results and then prints the full response, which exposes bearer credentials to the caller, logs, transcripts, or any downstream system capturing stdout. Because the same pattern is repeated across publish, update, delete, and matches operations, a leaked token could allow unauthorized access to recruiter APIs and job or candidate data.
- Content
Static analysis
No suspicious patterns detected.