企业招聘信息查询 - 聚合数据

• Outcome: Review
• Latest audit: Sep 8, 2026 · 7:45 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims: it queries Juhe for enterprise recruitment data, but users should handle the API key and queried company identifiers carefully.

Install only if you are comfortable sending company lookup values to Juhe. Prefer a secure environment variable or secret manager for JUHE_ENTERPRISE_RECRUITMENT_KEY, avoid passing the key with --key, and avoid storing it in scripts/.env unless permissions and git exclusion are controlled.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/enterprise_recruitment.py:241
• Finding: API Key Exposure Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/enterprise_recruitment.py:241-243` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium The script accepts the Juhe API key through the `--key` command-line option. The same insecure configuration method is explicitly documented in `SKILL.md:35-37`. ```python if args[i] == "--key" and i + 1 < len(args): cli_key = args[i + 1] i += 2 ``` ### Technical Analysis Command-line arguments are not an appropriate transport mechanism for secrets. Depending on the operating system and execution environment, arguments may be exposed through: - Process inspection utilities and process-monitoring services - Shell command history - CI/CD job logs and workflow telemetry - Debugging, auditing, or endpoint-monitoring software - Wrapper scripts that record invoked commands The script places the API key directly in `sys.argv` and does not warn users about these exposure channels. Although the key is legitimately transmitted to the declared Juhe API, accepting it through a command-line argument exceeds the minimum safe credential-handling behavior necessary for the Skill. ### Attack Path 1. A user follows the documented example and runs the script with `--key SECRET`. 2. The complete command is retained in shell history, captured by automation logs, or temporarily exposed through process metadata. 3. Another local user, system administrator, monitoring service, or person with access to the relevant logs retrieves the key. 4. The recovered key is used to call the Juhe API independently. 5. The attacker consumes the account's quota or causes billable API usage until the credential is revoked or restricted. ### Impact Assessment Exploitation does not grant operating-system privilege escalation or arbitrary code execution. It can grant unauthorized access to the Juhe API privileges associated with the exposed key. Th ...[truncated 173 chars]
• Remediation: ## Remediation Suggestions 1. Remove support for the `--key` command-line option, or deprecate it with a prominent security warning. 2. Prefer a dedicated secret manager or the existing `JUHE_ENTERPRISE_RECRUITMENT_KEY` environment variable. 3. If interactive use is required, read the key through `getpass.getpass()` so it is not displayed or recorded in shell history. 4. Update `SKILL.md` and the command help to remove examples that place credentials in command arguments. 5. Ensure exception messages, debug logs, and serialized output never contain the API key. 6. Recommend that users rotate any key previously supplied in logged commands and apply provider-side quota and API-scope restrictions.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/enterprise_recruitment.py:69
• Finding: Plaintext API Key Storage Without File-Permission Validation## Vulnerability Details **File Location**: `scripts/enterprise_recruitment.py:69-77` **Vulnerability Type**: Insecure plaintext credential storage **Risk Level**: Low The script reads an API key from a plaintext `.env` file in the Skill's script directory without checking ownership or permissions. ```python env_file = Path(__file__).parent / ".env" if env_file.exists(): for line in env_file.read_text(encoding="utf-8").splitlines(): line = line.strip() if line.startswith("JUHE_ENTERPRISE_RECRUITMENT_KEY="): val = line.split("=", 1)[1].strip().strip('"').strip("'") if val: return val ``` `SKILL.md:32-33` instructs users to create this file using a normal shell redirection: ```bash echo "JUHE_ENTERPRISE_RECRUITMENT_KEY=your AppKey" > scripts/.env ``` ### Technical Analysis The API key is stored unencrypted in a predictable file under the project tree. The implementation performs no validation that the file: - Is owned by the expected user - Is not readable by other local users - Is not a symbolic link - Has restrictive permissions - Is excluded from source control or artifact packaging Actual readability depends on the user's umask and environment. The predictable location also increases the likelihood that the file will be copied, archived, or committed with the project. ### Attack Path 1. A user follows the documentation and creates `scripts/.env`. 2. The file receives permissions based on the current umask, potentially allowing other local users or services to read it. 3. Alternatively, the project directory is committed, archived, backed up, or shared with the `.env` file included. 4. A party with access to the local file, repository, artifact, or backup reads the plaintext key. 5. The party reuses the credential against the Juhe API, consuming quota or generating billable requests. ### Impact Assessment Successful expl ...[truncated 366 chars]
• Remediation: ## Remediation Suggestions 1. Prefer an operating-system secret store or managed secret service instead of a plaintext `.env` file. 2. If `.env` support is retained, document creation with restrictive permissions, such as: ```bash install -m 600 /dev/null scripts/.env ``` 3. Validate that the file is owned by the current user and is not accessible by group or other users before reading it. 4. Reject symbolic links and unexpected file types to reduce redirection to attacker-controlled files. 5. Add `scripts/.env` and general `.env` patterns to `.gitignore` and package-exclusion rules. 6. Warn users not to place the file in shared directories, repositories, logs, or distributable archives. 7. Apply provider-side key scope, quota, and billing restrictions, and rotate any credential that may have been committed or shared.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The trigger phrases are broad and overlap with common requests such as '查一下招聘信息' and '薪资待遇', which can cause the skill to activate in contexts the user did not clearly intend. Because the skill sends enterprise identifiers and search terms to a third-party API, overbroad routing increases the chance of unintended data disclosure and unnecessary paid API calls.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The markdown explains the external API usage but does not clearly warn users that company names, registration numbers, or unified social credit codes are transmitted to a third-party service. This weakens informed consent and can expose potentially sensitive business-query data to an external processor without explicit notice.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script transmits user-provided enterprise identifiers together with an API key to a third-party service, but it does not clearly warn users that their query data leaves the local environment. In an agent/skill context, users may assume a local lookup, so this can create a privacy and data-handling risk, especially if identifiers are sensitive or regulated.

Credential Access

High

• Category: Privilege Escalation

Content

export JUHE_ENTERPRISE_RECRUITMENT_KEY=你的 AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_ENTERPRISE_RECRUITMENT_KEY=你的 AppKey" > scripts/.env

# 方式三：每次命令行传入
python scripts/enterprise_recruitment.py --key 你的 AppKey --name 天聚地合（苏州）数据股份有限公司

• Confidence: 86% confidence
• Finding: The documentation explicitly suggests placing the API key in `scripts/.env`, a plaintext file inside the project tree. In agent or shared-workspace environments, local files may be readable by other tools, accidentally committed to source control, or included in logs/backups, exposing a billable third-party credential.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/enterprise_recruitment.py:16