Security audit

Ai Interview

Security checks across malware telemetry and agentic risk

Overview

This AI interview skill is plausible, but its viewer can expose and delete OpenClaw session history more broadly than the documentation explains.

Review before installing. Use dedicated low-privilege Feishu apps, keep App Secrets out of source control, and only run the viewer on a trusted machine. Bind or firewall port 8091 to localhost, avoid leaving the viewer running, get consent before observing interview content, and back up OpenClaw session logs before using any clear-history function.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill documentation describes use of local files and a local web server, yet there is no explicit permission declaration covering file access or networking. In a skill ecosystem that relies on declared permissions for user trust and policy enforcement, this creates a transparency and least-privilege problem because operators may enable functionality without understanding that local files and network endpoints are involved.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented purpose emphasizes an AI interview system, but the referenced behavior includes direct reading of local OpenClaw session files and an undocumented '/api/clear' capability that deletes agent conversation data. This mismatch is dangerous because users may grant trust based on the advertised interview workflow while the implementation has materially different data access and destructive behavior affecting local conversation records.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The web viewer is described as a read/observe component, but it exposes `/api/clear`, which deletes all `.jsonl` session files for two chosen agents. This is a destructive capability with no authentication, no authorization, and no CSRF protection, so any local or reachable client can erase interview/session history and disrupt operations or destroy audit data.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The service has an unjustified destructive capability: `clear_conversations()` iterates over session files and unlinks them, and the handler exposes that behavior over HTTP. Because the skill context is an AI interview system handling conversation records, deletion can erase evidence, break observability, and remove potentially sensitive business records without controls.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The module docstring says the backend 'directly reads' agent session files, which implies a passive viewer, but the implementation also deletes session files. This mismatch is dangerous because reviewers or users may trust the service as read-only while it actually contains a destructive capability, increasing the chance of unsafe deployment and misuse.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The instructions tell users to place Feishu App Secret values into configuration without any warning that these are sensitive credentials. This increases the risk of accidental leakage through screenshots, source control, shared config files, or unsafe file permissions, which could enable unauthorized bot access.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The skill advertises a real-time observation panel for interview conversations but does not warn that interview content may be exposed to additional viewers. In an interview setting, discussions may contain personal data, employment history, or assessment notes, so lack of privacy disclosure can lead to unintended data exposure and consent issues.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The destructive `/api/clear` endpoint performs irreversible deletion with no confirmation, warning, authentication, or safety interlock. It is also triggered via GET, making accidental activation, link-triggering, and CSRF-style abuse much easier if the service is reachable from a browser or shared network.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: `/api/conversations` exposes complete agent conversation contents over unauthenticated HTTP and sets `Access-Control-Allow-Origin: *`, allowing broad cross-origin reads if the service is reachable. In the context of an interview system, these messages can contain sensitive candidate data, internal evaluation notes, or prompts, so unauthorized disclosure poses privacy and confidentiality risks.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.