个性化BOSS直聘打招呼生成器和JD对比

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:22 AM UTC
• Version: 1.0.0

Overview

This skill is job-search focused and not malicious, but it asks to store a sensitive resume profile locally while also requesting unnecessary shell access.

Install only if you are comfortable saving a detailed job-search profile on disk. Before using it, confirm where the profile is stored, how to delete it, avoid adding highly sensitive identifiers or confidential employer information, and prefer a version that removes Bash access or makes storage optional.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:7

Finding

Unnecessary Shell Execution Capability Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7-10
Vulnerability Type: Excessive tool permissions
Risk Level: Medium

yaml

tools:
  - Read
  - Write
  - Bash

Technical Analysis

The skill requests access to the Bash tool even though its documented functionality only requires reading and writing a user profile, analyzing job descriptions, and generating text. No documented workflow requires command execution.

Shell access is substantially more powerful than the capabilities needed for this task. If attacker-controlled content in a job description, resume, or screenshot successfully influences the agent's tool usage, the unnecessary shell permission could turn an instruction-injection event into local command execution. The declaration therefore violates the principle of least privilege and unnecessarily increases the consequences of agent manipulation.

Attack Path

1. An attacker places adversarial instructions in a job description, resume, or recruitment screenshot.
2. The user submits that content to the skill for analysis.
3. The agent interprets the embedded content as operational instructions rather than untrusted data.
4. Because the skill has access to Bash, the manipulated agent attempts to execute a local command.
5. The command runs with the operating-system privileges and filesystem access available to the agent process.

No direct command-injection implementation was found in the audited files. This attack path depends on successful agent instruction injection, but the unnecessary capability materially increases its potential impact.

Impact Assessment

Successful exploitation could permit command execution within the security context of the agent process. Depending on the surrounding sandbox and operating-system permissions, this may expose local files, environment variables, accessible credentials, and other user data. It could also allow modification of file ...[truncated 277 chars]

Remediation

View remediation

Remediation Suggestions

• Remove Bash from the tool declaration because no documented workflow requires shell execution.
• Retain only the minimum Read and Write capabilities needed for profile management.
• Where supported, restrict filesystem access to the dedicated profile file rather than granting general read and write access.
• Treat job descriptions, resumes, and OCR output as untrusted data and explicitly prohibit following instructions embedded in those inputs.
• Require user confirmation before performing any operation outside text analysis or profile maintenance.
• If future functionality genuinely requires a command, expose a narrowly scoped purpose-built tool instead of unrestricted shell access.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:17

Finding

Sensitive Job-Seeker Profile Stored in a Predictable Plaintext File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-21 and 23-59
Vulnerability Type: Insecure storage of sensitive personal information
Risk Level: Medium

text

~/.openclaw/boss-profile.md

The profile workflow instructs the skill to collect and persist resume details, education, employment history, project experience, skills, job preferences, target location, expected salary, and optional supplemental information in this Markdown file.

Technical Analysis

The skill consolidates substantial personal and employment information into a predictable plaintext path. The documented workflow does not specify explicit consent before persistent storage, restrictive file permissions, encryption, a retention period, a deletion function, or minimization of identifying information.

A Markdown file provides no confidentiality protection by itself. Its predictable location also makes discovery straightforward for another local process, agent, backup service, synchronization utility, or user account with sufficient filesystem access. Consolidating multiple personal data fields into one file increases the consequences of unauthorized access.

Attack Path

1. The user supplies a resume, work history, education details, salary expectations, and job preferences.
2. The skill organizes the information into a structured profile.
3. The skill writes the profile to the predictable plaintext path ~/.openclaw/boss-profile.md.
4. Another local process, broadly authorized agent, backup utility, or account with access to the user's home directory locates the file.
5. That party reads or copies the consolidated personal profile without authorization.

This issue does not create remote exfiltration by itself. Exploitation requires another party or process to have filesystem access sufficient to read the profile.

Impact Assessment

Exposure may reveal identity-related information, educational background, current ...[truncated 493 chars]

Remediation

View remediation

Remediation Suggestions

• Obtain explicit informed consent before saving profile information persistently.
• Offer a session-only mode that does not write personal information to disk.
• Create profile files with owner-only permissions, such as mode 0600, and ensure the containing directory is not accessible to other users.
• Use secure operating-system credential or application storage where available instead of an unprotected Markdown file.
• Minimize collected data and avoid storing fields not necessary for message generation.
• Add commands that allow users to inspect, selectively redact, and permanently delete their stored profile.
• Define a retention period and automatically remove profiles that are no longer needed.
• Warn users not to include government identifiers, account credentials, private contact details, or unrelated confidential employer information.
• Prevent profile contents from being copied into logs, diagnostics, or unrelated model context.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to collect extensive personal data—resume details, work history, certificates, salary expectations, and potentially screenshots—and persist it locally without an explicit privacy warning or informed consent step. Because this is long-lived profile storage on disk, the risk includes unintentional retention, later disclosure, and collection of more sensitive data than users may expect from a chat interaction.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger terms are broad and cover common job-search language, which can cause the skill to activate in conversations where the user did not intend profile persistence or JD processing. In this skill's context, unexpected activation is more dangerous because it can lead to collection and storage of sensitive resume, job preference, and screenshot data without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill requests Bash even though its documented behavior only requires reading/writing a profile file and generating text. Granting shell execution unnecessarily expands the attack surface: if later prompt content, OCR text, or future modifications influence tool use, the agent could execute unintended commands on the local system.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This duplicate finding points to the same persistent local storage capability enabled by Write and the documented profile file path. Although persistence supports the skill's intended workflow, it increases exposure of resume data, job preferences, and potentially sensitive screenshots if local files are later read by other skills, users, or processes.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

emoji: 🦞
tools:
  - Read
  - Write
  - Bash
---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This duplicate finding points to the same persistent local storage capability enabled by Write and the documented profile file path. Although persistence supports the skill's intended workflow, it increases exposure of resume data, job preferences, and potentially sensitive screenshots if local files are later read by other skills, users, or processes.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

emoji: 🦞
tools:
  - Read
  - Write
  - Bash
---

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The scripted prompt to the user is fixed in Chinese, and the rest of the skill is written to generate content in that language by default. There is no indication that the user can choose another language or that the Chinese-only behavior is a documented, justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file contains user-facing instructional content exclusively in Chinese, and there is no indication that the skill is limited to Chinese-speaking users or that language selection is optional. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a locale policy issue.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The file documents the archive location as ~/.openclaw/boss-profile.md and repeatedly instructs direct reads/writes to that path, while L157 separately states the agent should never expose the full path in conversation. This is an intent-level contradiction in the skill documentation about whether the path should be surfaced or kept hidden.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown template is written entirely in Chinese and sets a default tone in Chinese, which can impose a specific language/locale on users without any opt-in or alternative. The policy allows language constraints only when the skill offers a choice or clearly documents a justified regional scope, neither of which appears here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.