Security audit

HireMate — AI招聘助手

Security checks for vulnerabilities and agentic risk

Overview

HireMate is a local recruiting helper, but it should be reviewed because it processes sensitive candidate data and makes hiring or compensation recommendations without enough privacy, fairness, or scope guardrails.

Review this skill before installing in a workplace recruiting flow. Use redacted candidate data where possible, store output files securely, treat scores and recommendations as advisory only, and ensure any screening, salary, language, cultural-fit, or hire/no-hire criteria are validated against your organization's hiring policy and applicable law.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill exposes file read/write capability through script usage and `--output` / `@file_path` patterns, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, undeclared capabilities increase the chance of the skill being invoked with broader filesystem access than intended, making accidental data exposure or overwriting of local files more likely.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger list includes very broad terms such as `hire`, `recruit`, `JD`, and `compensation`, which are common in ordinary conversation and can cause the skill to activate outside the user's intent. Because this skill handles resume scoring, candidate matching, and salary analysis, unintended activation could route sensitive HR-related prompts into automated processing without the user clearly opting in.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill processes resumes, candidate evaluations, interview feedback, and compensation data, all of which can contain sensitive personal or confidential employment information, yet the description provides no warning or handling guidance. In this context, missing privacy guidance is more dangerous because users may paste full resumes or interview notes containing PII, leading to unnecessary collection, retention, or disclosure of candidate data.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The screening template includes 'Multilingual capabilities' as a default nice-to-have criterion for sales representatives without requiring a job-related justification or explicit user opt-in. In a recruiting skill, default language-based screening can contribute to discriminatory hiring practices, especially if used in jurisdictions where language requirements must be demonstrably necessary for the role.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The script hard-codes 'Cultural Fit' as a weighted hiring criterion, which can operationalize subjective or biased judgments in employment decisions without any guardrails, justification, or anti-discrimination controls. In a recruiting skill, this is especially risky because it may encourage evaluators to score candidates on vague alignment factors that can proxy for protected characteristics and create compliance and fairness exposure.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This code writes an interview evaluation report containing candidate name, strengths, concerns, and notes to an arbitrary output file, but the only user-facing message appears after the write completes. There is no prior disclosure in the CLI help, docstring, or surrounding comments that the file may contain sensitive hiring-related personal data.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The function unconditionally looks up salary data under `salary_db['regions']['us']`, which hard-codes US market assumptions into compensation guidance without checking the user's locale or obtaining explicit opt-in. In a recruiting tool, this can produce misleading salary recommendations, materially bias hiring or compensation decisions, and expose the organization to compliance and fairness issues when used for non-US roles.

Static analysis

No suspicious patterns detected.