ClawHub
Back to skill

Security audit

Ai Interview

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent AI interview purpose, but its web viewer can expose and delete local OpenClaw conversation logs without proper access controls.

Review or fix server.py before installing. Keep the viewer bound to localhost only, do not expose port 8091 to a network, restrict access to the two intended agents, remove or protect the clear endpoint, and store Feishu app secrets carefully outside version control with a rotation plan.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
server.py:145
Finding

Unauthenticated Network Exposure of Agent Session Conversations

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
server.py:29
Finding

Filesystem Path Traversal Through Unvalidated Agent Names

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
server.py:206
Finding

Unauthenticated Destructive Session Deletion Through a GET Endpoint

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)

Tp1

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Zero-width Unicode characters are invisible to humans but detectable by AI. When followed by visible text, they indicate hidden content injection.

Content

No source excerpt is available for this finding.

Tp1

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Zero-width Unicode characters are invisible to humans but detectable by AI. When followed by visible text, they indicate hidden content injection.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documentation markets the skill as an AI interview system with Feishu bots and MoonShot integration, but the broader analysis indicates the implemented behavior includes undeclared local session-file read/delete functionality while omitting core declared features. A mismatch like this is dangerous because users may install or run the skill under false assumptions, exposing local data or destructive actions not disclosed by the manifest.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: ai-interview
description: |
  🤖 AI 面试系统 - 完整的 AI 面试解决方案
  
  提供求职者和面试官两个 AI Agent，支持飞书群聊面试 + 实时可视化观察。
  
  **功能：**
  - 👨‍💻 job-seeker - AI 求职者（3年前端，微前端经验）
  - 👨‍💼 recruiter - AI 面试官（提问、评估候选人）
  - 📊 web-viewer - 实时可视化观察面板
  
  **依赖：**
  - 飞书应用 x2（job-seeker + recruiter）
  - MoonShot API Key
  
  **触发词：**
  - "安装 ai-interview"
  - "安装面试系统"
  - "ai-interview"
metadata:
  version: "1.0.0"

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The /api/clear endpoint performs remote deletion of agent session .jsonl files with no authentication, no authorization, and permissive CORS headers elsewhere in the API. Because these logs likely contain conversation history and evidence of agent behavior, unauthenticated deletion can destroy audit trails and interfere with monitoring or incident investigation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill declares operational capabilities that imply file reading and network use, but it does not specify any tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where an agent or runtime may grant broader access than users expect, especially since the documentation also instructs users to run local scripts and a Python server.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The natural-language content, including description, setup steps, and usage instructions, is exclusively in Chinese. Under the policy rule, forcing a specific language without user opt-in or documented justification is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill instructs users to place Feishu App Secrets directly into a local configuration file without any warning about secret handling, storage protections, or rotation. This increases the chance of credential leakage through file exposure, backups, screenshots, version control, or overly broad filesystem access by other tools.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The file’s entire identity and behavior instructions are written only in Chinese and define the agent persona and response behavior without offering any user language choice or opt-in. Under the policy for natural-language violations, forcing a specific language/locale without user choice is in scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file’s natural-language instructions are entirely written in Chinese and define the agent persona and interview flow without offering any language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document declares lang="zh-CN", and the visible UI text throughout the page is Chinese, which indicates the skill is fixed to a specific language/locale. There is no visible user opt-in, language selector, or documentation that this is intentionally limited to a China-specific context, so this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 17)May include surrounding context.

sh
# 创建工作空间
echo "📁 创建 Agent 工作空间..."
mkdir -p ~/.openclaw/workspace-job-seeker
mkdir -p ~/.openclaw/workspace-recruiter

# 复制配置模板

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The web viewer is described as an observation panel, but the backend also exposes a destructive capability that deletes session logs for selected agents. This creates an unexpected integrity risk because anyone who can reach the server can trigger deletion via a simple GET request, undermining auditability and observability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

A destructive endpoint is exposed without any confirmation, warning, or secondary check, so accidental or scripted requests can immediately erase session files. This increases the likelihood of both misuse and operator error, especially in a tool framed as a passive real-time viewer.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script's user-facing comments and prompts are presented in Chinese only, including the installation guidance and interactive prompt. This can violate a language/locale policy when a skill forces a specific language without opt-in or alternative locale support.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The file-level natural-language description is entirely in Chinese and presents the service purpose only in that language, with no indication that users may choose another language. This can violate language/locale policy when a skill implicitly constrains interaction or documentation to a single language without opt-in or justification.

Content

No source excerpt is available for this finding.