Security audit

Pm Interview Coach

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent PM interview coach, but its external Xiaohongshu and vision-model workflow is under-disclosed and its helper script handles tokens and downloaded images unsafely.

Install only if you are comfortable with the skill using Xiaohongshu and an external vision model as part of coaching. Prefer redacting resume contact details, avoid putting real tokens on the command line, use an isolated Python virtual environment, and treat the image-fetching helper as unsafe unless it is updated with URL validation, size limits, safe filenames, and explicit cleanup.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch_xhs_interview.py:31
Finding: Unvalidated image URLs and feed identifiers enable SSRF and arbitrary file writes
Content: View full analysis
{output_path}") ``` ### Technical Analysis The script treats image URLs returned by the MCP service as trusted and passes them directly to `urllib.request.urlopen`. It does not restrict the URI scheme, destination hostname, resolved IP address, redirect destination, response type, or response size. Consequently, a compromised or malicious MCP response could direct the script to an attacker-controlled server or to services r ...[truncated 2375 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_xhs_interview.py:4
Finding: Sensitive access token is exposed through process arguments and plaintext local HTTP
Content: View full analysis
""" ``` ```python def fetch_feed_detail(feed_id, xsec_token): mcp_url = "http://localhost:18060/mcp" payload = { "jsonrpc": "2.0", "method": "tools/call", "params": { "name": "get_feed_detail", "arguments": {"feed_id": feed_id, "xsec_token": xsec_token} }, "id": 1 } data = json.dumps(payload).encode("utf-8") req = urllib.request.Request( mcp_url, data=data, headers={"Content-Type": "application/json", "Accept": "application/json"} ) with urllib.request.urlopen(req, timeout=30) as response: result = json.loads(response.read().decode("utf-8")) return result.get("result", {}) ``` ```python if len(sys.argv) < 3: print("Usage: python3 fetch_xhs_interview.py ") sys.exit(1) feed_id = sys.argv[1] xsec_token = sys.argv[2] print(f"Fetching feed: {feed_id}", file=sys.stderr) result = fetch_feed_detail(feed_id, xsec_token) ``` ### Technical Analysis The documented invocation requires the Xiaohongshu `xsec_token` to be supplied as a command-line argument. Command-line arguments may be retained in shell history and can be exposed through process-inspection interfaces, monitoring agents, crash diagnostics, terminal logs, or administrative tooling. The token is then included in a JSON-RPC body sent over unauthenticated plaintext HTTP to `localhost:18060`. Although the destination is loopback-only, the client does not authenticate the server owning that port. If a malicious local process binds the port before the legitimate MCP service, it can receive the token. The token is necessary to ...[truncated 1389 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:29
Finding: Installation instructions use unpinned dependencies and bypass system package protections
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior materially exceeds the declared purpose: instead of only coaching from user-provided resume and role data, it mandates scraping Xiaohongshu content, processing tokens, and using external tooling. This mismatch undermines informed consent and can cause the agent to collect or transmit third-party and possibly user-linked data outside the expected coaching workflow.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The security statement says no resume or personal information is uploaded or transmitted and that all processing is local, but the workflow requires external social-media search and an external AI vision model. This is a direct trust and disclosure failure: users may provide sensitive resume data under false assumptions about where it may flow or what external services are involved.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script reaches outside the stated interview-coaching scope by calling a local MCP service to fetch third-party Xiaohongshu post details and then processing external content. This creates unnecessary data-ingestion capability that can expose user tokens, pull untrusted content into the skill workflow, and broaden the attack surface beyond the declared resume-based coaching function.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README states that the skill reads resumes, searches external Xiaohongshu content, and uses a vision model to process images, but it does not clearly warn users that highly sensitive career and personal data may be sent to third-party services. In this context, resumes often contain names, contact details, employment history, and other personal information, so missing privacy disclosure and consent handling creates meaningful data exposure risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases are generic interview-related terms that are likely to appear in ordinary conversation, which can cause the skill to activate unintentionally. Because the skill then requests resumes, job targets, and may invoke external services, overbroad activation increases the chance of collecting or processing sensitive personal data without clear user intent.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill invokes external/network-capable actions but declares no explicit tool scope or permissions boundary. That makes data flow and execution authority ambiguous, increasing the chance the agent can access network resources beyond what users expect from a resume-coaching skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill presents itself as interview coaching based on resume and target role, yet its mandatory flow requires external Xiaohongshu searches before proceeding. This unnecessary dependency expands attack surface and data exposure beyond the core function, especially in a context involving resumes and career-related personal information.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The activation examples include phrases like "帮我练习面试" and "面试练习", which are broad enough to match ordinary user requests outside a tightly scoped skill invocation context. The description does not provide exclusion conditions or negative examples to clarify when the skill should not activate.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Natural-language instructions throughout the file assume Chinese as the required interaction language, but there is no opt-in, fallback, or explanation that the skill is intentionally limited to a Chinese-language audience. This can violate language/locale policy when a skill effectively forces one language without user choice.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Calling a third-party social platform and a vision model to parse images adds capabilities unrelated to the minimum required for interview coaching. Extra capabilities increase exposure to prompt injection, untrusted content handling, third-party policy issues, and accidental disclosure through external APIs.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script downloads remote images and writes them into the user's workspace, even though persistent file creation is not necessary for basic interview coaching. Storing attacker-controlled remote content locally can consume disk space, leave unwanted artifacts, and create downstream risk if other tools later open or process those files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The README is entirely in Chinese and presents the skill behavior, triggers, and workflow only in Chinese, with no indication that users may choose another language. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy concern unless the locale restriction is explicit and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file presents all guidance in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy for natural-language violations, forcing a specific language without user opt-in can be non-compliant.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.