ClawHub
Back to skill

Security audit

BOSS直聘手机号提取器

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed BOSS Zhipin phone-number extractor, but it needs Review because it collects private chat contact data and documents unattended reuse without enough safeguards.

Install only if you are authorized to process the chat participants' contact data. Treat the output file as sensitive, choose a protected location, delete it when no longer needed, avoid broad unattended scans, and do not enable cron, saved-session reuse, proxies, or Telegram notifications unless you understand the privacy and account-security implications.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Warning
Location
references/setup.md:62
Finding

Opt-In Scheduled Task Enables Persistent Unattended Access to Private Messages

Content
View full analysis

Vulnerability Details

File Location: references/setup.md, lines 62-69
Vulnerability Type: T06: System Persistence
Risk Level: Medium

Vulnerable Code

bash
crontab -e

*/30 * * * * cd ~/.openclaw/workspace/skills/zhipin-phone-extractor && python scripts/extract_phones.py --headless

Technical Analysis

The setup guide instructs users to create a cron job that runs the extractor in headless mode every 30 minutes. This scheduled task survives the original Skill invocation and causes recurring execution across user sessions.

Periodic monitoring is presented as an optional extension of the Skill, but persistence is not required for its core one-time phone-number extraction function. Once configured, the task repeatedly attempts to access authenticated recruitment chats and append extracted names, companies, and phone numbers to a local plaintext file without requiring approval for each execution.

The cron command also executes the script directly from a user-writable Skill directory. If that script or directory is subsequently modified by another process or account with write access, the modified code will inherit the established execution schedule.

The project does not silently install the cron entry: the user must explicitly edit the crontab. Nevertheless, the instructions do not provide equivalent removal, integrity protection, execution logging, or lifecycle guidance.

Attack Path

  1. A user follows the setup guide and adds the documented entry to their crontab.
  2. The cron daemon executes the Python script every 30 minutes, including after the original interactive session ends.
  3. The script attempts to access BOSS Zhipin chats in headless mode and writes extracted personal information to disk.
  4. The user may forget that the recurring task remains active, allowing continued collection of private contact data.
  5. If an attacker or another local process later modifies `scripts/ ...[truncated 854 chars]
Remediation
View remediation

Remediation Suggestions

  1. Keep scheduled execution strictly optional and require explicit informed consent before installation.
  2. Clearly disclose that the cron entry persists across sessions and repeatedly accesses private chat data.
  3. Provide an exact removal procedure, including how to identify and delete the installed crontab entry.
  4. Prefer a dedicated scheduler configuration with an explicit enable/disable lifecycle instead of manual crontab editing.
  5. Use an absolute, trusted Python interpreter path and a fixed script path.
  6. Restrict write permissions on the scheduled script and its parent directory.
  7. Add execution logs, failure reporting, and a documented data-retention policy.
  8. Require explicit configuration of the output location and protect the output file with restrictive permissions.
  9. Consider requiring interactive confirmation before accessing chats unless the user has separately enabled unattended mode.

T08 · Insecure Dependencies

Warning
Location
references/setup.md:6
Finding

Unpinned Playwright and Chromium Installation Creates Supply-Chain Exposure

Content
View full analysis

Vulnerability Details

File Location: references/setup.md, lines 6-9 and 87-89; SKILL.md, line 89
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash
pip install playwright
playwright install chromium

The troubleshooting instructions additionally permit browser downloads through a mutable third-party mirror:

bash
export PLAYWRIGHT_DOWNLOAD_HOST=https://npmmirror.com/mirrors/playwright/
playwright install chromium

Technical Analysis

The installation instructions do not pin a reviewed Playwright version and do not verify package or browser artifact integrity. Consequently, the installed package and Chromium build are resolved at installation time and may differ from the versions originally reviewed.

The alternate troubleshooting procedure redirects Playwright's browser download mechanism to a third-party mirror. This expands the supply-chain trust boundary beyond the official package and browser distribution infrastructure. No checksum, signature verification, lock file, or reviewed version constraint is provided.

Playwright and Chromium are security-sensitive dependencies because they execute native and Python code, process untrusted web content, and access authenticated recruitment messages. A compromised package index account, dependency artifact, browser build, mirror, or download path could therefore introduce code running with the installing user's permissions.

This finding does not establish that the named Playwright package or mirror is currently malicious. The vulnerability is the mutable, unverified dependency installation process.

Attack Path

  1. A user follows the documented installation commands.
  2. pip resolves the latest available Playwright release rather than a version reviewed with this Skill.
  3. Playwright downloads a Chromium executable without project-provided integrity validation.
  4. If the package source, ...[truncated 1247 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin Playwright to a reviewed version in a dependency manifest, for example with an exact version constraint.
  2. Use a lock file or hash-validated requirements file, such as pip install --require-hashes -r requirements.txt.
  3. Document the expected Chromium revision associated with the pinned Playwright release.
  4. Prefer official package indexes and official Playwright browser download infrastructure.
  5. Remove the third-party mirror recommendation or require independent checksum or signature verification before use.
  6. Install dependencies in a dedicated virtual environment with minimal filesystem permissions.
  7. Periodically review and deliberately update pinned dependencies rather than automatically consuming the newest release.
  8. Run dependency and artifact vulnerability scanning as part of the release process.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script automates collection of phone numbers from private chat messages on zhipin.com and persists them to a local text file without any consent check, minimization, retention control, or warning about handling personal data. In context, this is sensitive PII scraping from a messaging interface after login, which creates significant privacy, compliance, and abuse risk if the data is harvested, retained insecurely, or reused beyond the original conversation context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger conditions are broad and include multiple generic terms and contexts, which can cause the skill to activate when the user did not clearly request bulk extraction of contact data. Because the skill automates collection of phone numbers from private recruiting chats, ambiguous activation increases the risk of unintended privacy-invasive actions and unauthorized handling of personal data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is designed to extract and persist personal phone numbers from chat messages, but it does not present a prominent warning about privacy, consent, retention, or the sensitivity of exported contact data. This is dangerous because it normalizes bulk collection and storage of personal identifiers, increasing the risk of misuse, accidental disclosure, or noncompliance with privacy expectations and platform rules.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This section instructs users to log into a real recruiting account, extract phone numbers, save cookies, and write contact data to disk without warning that the data is sensitive personal information. Omitting privacy, retention, and account-security guidance makes misuse or accidental disclosure more likely in a workflow handling PII and authenticated access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The documentation frames the tool as a phone-number extractor but also states that authenticated browser cookies are persisted for reuse. Persisted session state materially increases sensitivity because anyone with access to that state may be able to reuse the account session, and the guide does not clearly warn users about that risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The scheduled headless execution and Telegram notification guidance encourages unattended collection and possible onward sharing of extracted information, but it omits warnings about automation risk, exposure through third-party messaging, and broader data-protection implications. In context, automation increases scale and persistence of collection, which makes accidental or unauthorized disclosure more dangerous.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

The cron-based headless automation implies repeated reuse of an authenticated session over time, which increases the attack window and operational risk if the stored session state or host is compromised. In combination with persisted cookies and PII extraction, unattended execution makes collection more durable and less visible to the user.

Content

Scanner excerpt · references/setup.md (reported line 66)May include surrounding context.

bash
# 编辑 crontab
crontab -e

# 每 30 分钟检查一次
*/30 * * * * cd ~/.openclaw/workspace/skills/zhipin-phone-extractor && python scripts/extract_phones.py --headless

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide presents the skill as a local extraction workflow, then later introduces sending results to Telegram, which adds third-party transmission of extracted personal data. Even if the example only sends counts in the snippet shown, it normalizes external delivery of data-related events without a prominent warning or consent model, increasing privacy and data-leak risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Referencing the Telegram API endpoint explicitly confirms dependence on a third-party service for outbound communication. In a skill centered on scraping and storing phone numbers, this expands the trust boundary and can expose sensitive operational metadata or personal data if users adapt the example without safeguards.

Content

Scanner excerpt · references/setup.md (reported line 126)May include surrounding context.

python
# 发送到 Telegram
import requests
requests.post(f"https://api.telegram.org/bot{TOKEN}/sendMessage", json={
    "chat_id": CHAT_ID,
    "text": f"新提取 {len(unique_phones)} 个手机号！"
})

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Referencing the Telegram API endpoint explicitly confirms dependence on a third-party service for outbound communication. In a skill centered on scraping and storing phone numbers, this expands the trust boundary and can expose sensitive operational metadata or personal data if users adapt the example without safeguards.

Content

Scanner excerpt · references/setup.md (reported line 126)May include surrounding context.

python
# 发送到 Telegram
import requests
requests.post(f"https://api.telegram.org/bot{TOKEN}/sendMessage", json={
    "chat_id": CHAT_ID,
    "text": f"新提取 {len(unique_phones)} 个手机号！"
})

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The script's title, help text, and runtime messages are all hard-coded in Chinese, which imposes a specific language on users without opt-in or alternative locale support. This matches the policy concern for language or locale constraints that are not optional or explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
73% confidence
Finding

The user-facing instructions and examples are presented entirely in Chinese, which can amount to forcing a specific language without opt-in. The file does not state that the skill is intentionally limited to Chinese-speaking users or offer an alternative language option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

A file-wide instruction set that effectively forces one language can violate a language/locale policy when no opt-in or justification is provided. Here, the documentation is fully Chinese-language and does not indicate that the locale restriction is optional or required for a region-specific compliance reason.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The module and class describe themselves as a BOSS直聘 phone extractor, but the default output path is set to a file named "猎聘手机号记录.txt". This is an active documentation/intent mismatch in user-facing behavior because the saved artifact is labeled as belonging to a different platform than the one the code extracts from.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.