ClawHub
Back to skill

Security audit

企业招聘信息查询 - 聚合数据

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Juhe recruitment lookup tool, with the main caution that it handles a Juhe API key and sends company identifiers to Juhe.

Install only if you are comfortable using Juhe for this lookup and with company identifiers being sent to Juhe. Prefer a managed environment variable for JUHE_ENTERPRISE_RECRUITMENT_KEY; avoid passing the key on the command line or in a URL, and do not commit scripts/.env if you use it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/enterprise_recruitment.py:242
Finding

API Key Exposure Through Command-Line Arguments and Plaintext Local Storage

Content
View full analysis

Vulnerability Details

File Location: scripts/enterprise_recruitment.py:62-77, 242-244 and SKILL.md:29-33, 79
Vulnerability Type: API credential exposure
Risk Level: Medium

Vulnerable Code

The script accepts the API key directly as a command-line argument:

python
if args[i] == "--key" and i + 1 < len(args):
    cli_key = args[i + 1]
    i += 2

It also reads the credential from a plaintext file without checking ownership or permissions:

python
def load_api_key(cli_key: str = None) -> str:
    if cli_key:
        return cli_key

    env_key = os.environ.get("JUHE_ENTERPRISE_RECRUITMENT_KEY", "").strip()
    if env_key:
        return env_key

    env_file = Path(__file__).parent / ".env"
    if env_file.exists():
        for line in env_file.read_text(encoding="utf-8").splitlines():
            line = line.strip()
            if line.startswith("JUHE_ENTERPRISE_RECRUITMENT_KEY="):
                val = line.split("=", 1)[1].strip().strip('"').strip("'")
                if val:
                    return val

    return ""

The documentation additionally instructs users to place the key in scripts/.env, pass it on the command line, and includes a direct GET request example with the key in the URL.

Technical Analysis

Command-line arguments are not an appropriate secret-transport mechanism. Depending on the operating system and execution environment, arguments can be exposed through:

  • Process inspection tools and process metadata.
  • Shell command history.
  • Job runners, terminal session records, and automation logs.
  • Error reports or monitoring systems that record complete commands.

The local .env fallback stores the API key in plaintext inside the project tree. The script does not verify that the file is owned by the current user or restricted to owner-only access. It also does not ensure that the file is excluded from version control. ...[truncated 2315 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove support for the --key command-line argument so credentials cannot be supplied through process arguments.
  2. Prefer environment-variable injection from a trusted runtime secret store, such as a CI/CD secret manager, container secret, operating-system credential service, or orchestrator-managed secret.
  3. Remove the GET example containing key=YOUR_KEY. Document only the HTTPS POST workflow and avoid placing credentials in URLs.
  4. If .env support must remain:
    • Require owner-only permissions, such as mode 0600 on POSIX systems.
    • Reject the file or display a prominent warning when group or world access is enabled.
    • Verify that the file is a regular file and is owned by the expected user.
    • Add scripts/.env and .env to .gitignore.
    • Clearly warn users never to commit or distribute the file.
  5. Avoid logging complete commands, request bodies, or credential-bearing configuration values.
  6. Recommend immediate key rotation if a key has previously appeared in shell history, repository history, process logs, or URL logs.
  7. Consider reading the key interactively with hidden input when environment-based secret injection is unavailable.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The skill recommends writing the API key into scripts/.env, which creates a plaintext secret file in the working tree and increases the likelihood of accidental disclosure through backups, file reads, misconfigured permissions, or source control commits. In an agent environment with file access, local secret files also expand the attack surface compared with process environment injection.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
export JUHE_ENTERPRISE_RECRUITMENT_KEY=你的 AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_ENTERPRISE_RECRUITMENT_KEY=你的 AppKey" > scripts/.env

# 方式三：每次命令行传入
python scripts/enterprise_recruitment.py --key 你的 AppKey --name 天聚地合（苏州）数据股份有限公司

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python enterprise_recruitment.py --key your_api_key --name 企业全名
    2. 环境变量：export JUHE_ENTERPRISE_RECRUITMENT_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_ENTERPRISE_RECRUITMENT_KEY=your_api_key

申请 API Key: https://www.juhe.cn/docs/api/id/852
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/enterprise_recruitment.py (reported line 14)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python enterprise_recruitment.py --key your_api_key --name 企业全名
    2. 环境变量：export JUHE_ENTERPRISE_RECRUITMENT_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_ENTERPRISE_RECRUITMENT_KEY=your_api_key

申请 API Key: https://www.juhe.cn/docs/api/id/852
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/enterprise_recruitment.py (reported line 292)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python enterprise_recruitment.py --key your_api_key --name 企业全名
    2. 环境变量：export JUHE_ENTERPRISE_RECRUITMENT_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_ENTERPRISE_RECRUITMENT_KEY=your_api_key

申请 API Key: https://www.juhe.cn/docs/api/id/852
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/enterprise_recruitment.py (reported line 69)May include surrounding context.

python
if env_key:
        return env_key

    env_file = Path(__file__).parent / ".env"
    if env_file.exists():
        for line in env_file.read_text(encoding="utf-8").splitlines():
            line = line.strip()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill clearly performs network access, reads environment-based secrets, and references local files/scripts, but it does not declare an explicit tool scope such as allowed tools or permissions. This can lead to overbroad execution authority at runtime and makes it harder for users or the platform to understand and constrain what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger phrases are broad enough to match ordinary employment-related conversation, which raises the chance the skill activates when a user is merely discussing jobs rather than explicitly consenting to a third-party lookup. Because activation causes external querying of company identifiers, overbroad routing increases privacy and unintended-action risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill does not prominently warn users that company names, registration numbers, or unified social credit codes will be transmitted to a third-party API provider. This weakens informed consent and can expose potentially sensitive business identifiers to an external service without sufficient user awareness.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

该代码文件中的自然语言说明、帮助信息和运行输出均固定为中文，没有提供语言切换、用户选择或明确声明这是仅面向中文用户/特定地区的工具。按规则，强制特定语言而无用户 opt-in 属于自然语言/locale 策略问题。

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/enterprise_recruitment.py:16