T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/capture_boss_window.py:102- Finding
Nearby Unrelated Windows Can Be Selected and Captured
- Content
View full analysis
- Remediation
View remediation
Security audit
Boss Zhipin Watcher
Security checks for vulnerabilities and agentic risk
Overview
This skill can automate recruiting actions, messages, screenshots, and local data storage in ways that are broader and less controlled than a simple BOSS window screenshot helper.
Review carefully before installing. Use this only if you explicitly want an agent to control your BOSS account, capture candidate screens, store local records, and potentially send recruiting messages. Prefer a separate, narrowly scoped screenshot-only skill, remove shell workflow execution, require confirmation before every outbound message or resume action, keep PyAutoGUI fail-safe enabled, and add retention/redaction rules for captured candidate data.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/auto_task.py:15- Finding
Unattended Fixed-Coordinate Automation Disables the Emergency Stop and Performs Unverified Bulk Actions
- Content
View full analysis
= initial_data["targets"]["greetings"]: break ``` The optimized workflow also performs an external communication action when OCR fails: ```python # 使用OCR识别内容 try: result = subprocess.run(["node", OCR_SCRIPT, chat_screenshot, "--lang", "chi_sim"], capture_output=True, text=True, encoding='utf-8', errors='ignore') message = result.stdout.strip() if message: print(f"📝 识别到消息: {message[:100]}...") # 根据消息内容回复 if "微信" in message or "加" in message: self.reply_wechat_request() elif "简历" in message: self.request_resume() else: self.send_general_reply() else: print("📝 未识别到有效消息") except Exception as e: print(f"⚠️ OCR识别失败: {str(e)}") # 默认发送微信请求 self.reply_wechat_request() ``` ### Technical Analysis PyAutoGUI's fail-safe normally allows a user to abort automation by moving the pointer to a screen corner. Explicitly disabling it removes a critical emergency-control mechanism. The automation then executes up to 60 repeated clicks at a static coordinate without confirming the control under the pointer or validating the UI result after each action. Window movement, scaling, layout changes, delayed rendering, overlays, or focus changes can redirect these actions to unintended controls or applications. The related OCR flow is also fa ...[truncated 1513 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/workflow_runner.py:58- Finding
Caller-Selected Workflow Commands Are Executed Through a Shell
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:72- Finding
Installation Instructions Use Unpinned Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (98)
Description-Behavior Mismatch
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill metadata says it only identifies the BOSS window and returns a screenshot, but the implementation performs full recruiting workflow automation including filtering candidates, greeting them, processing chats, collecting resumes, and generating KPI summaries. This severe mismatch is dangerous because callers may grant permissions or invoke the skill expecting passive capture, while the code can actively manipulate user accounts and candidate communications.
- Content
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The exec tool path directly supports arbitrary shell command execution from workflow content, which is far beyond the stated screenshot-only purpose. In an agent skill, this creates a direct path to system compromise, data exfiltration, persistence, or destructive actions if the workflow file is modified or attacker-controlled.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation expands the skill into automated recruiting workflows such as filtering candidates, sending greetings, parsing chats, soliciting resumes/WeChat, and KPI-driven loops. In context, this transforms a nominally passive screenshot tool into a system capable of acting on sensitive personal data and communicating with external parties.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documentation expands the skill into automated recruiting workflows such as filtering candidates, sending greetings, parsing chats, soliciting resumes/WeChat, and KPI-driven loops. In context, this transforms a nominally passive screenshot tool into a system capable of acting on sensitive personal data and communicating with external parties.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation expands the skill into automated recruiting workflows such as filtering candidates, sending greetings, parsing chats, soliciting resumes/WeChat, and KPI-driven loops. In context, this transforms a nominally passive screenshot tool into a system capable of acting on sensitive personal data and communicating with external parties.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documentation expands the skill into automated recruiting workflows such as filtering candidates, sending greetings, parsing chats, soliciting resumes/WeChat, and KPI-driven loops. In context, this transforms a nominally passive screenshot tool into a system capable of acting on sensitive personal data and communicating with external parties.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documentation expands the skill into automated recruiting workflows such as filtering candidates, sending greetings, parsing chats, soliciting resumes/WeChat, and KPI-driven loops. In context, this transforms a nominally passive screenshot tool into a system capable of acting on sensitive personal data and communicating with external parties.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documentation expands the skill into automated recruiting workflows such as filtering candidates, sending greetings, parsing chats, soliciting resumes/WeChat, and KPI-driven loops. In context, this transforms a nominally passive screenshot tool into a system capable of acting on sensitive personal data and communicating with external parties.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation expands the skill into automated recruiting workflows such as filtering candidates, sending greetings, parsing chats, soliciting resumes/WeChat, and KPI-driven loops. In context, this transforms a nominally passive screenshot tool into a system capable of acting on sensitive personal data and communicating with external parties.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation expands the skill into automated recruiting workflows such as filtering candidates, sending greetings, parsing chats, soliciting resumes/WeChat, and KPI-driven loops. In context, this transforms a nominally passive screenshot tool into a system capable of acting on sensitive personal data and communicating with external parties.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation expands the skill into automated recruiting workflows such as filtering candidates, sending greetings, parsing chats, soliciting resumes/WeChat, and KPI-driven loops. In context, this transforms a nominally passive screenshot tool into a system capable of acting on sensitive personal data and communicating with external parties.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documentation expands the skill into automated recruiting workflows such as filtering candidates, sending greetings, parsing chats, soliciting resumes/WeChat, and KPI-driven loops. In context, this transforms a nominally passive screenshot tool into a system capable of acting on sensitive personal data and communicating with external parties.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation expands the skill into automated recruiting workflows such as filtering candidates, sending greetings, parsing chats, soliciting resumes/WeChat, and KPI-driven loops. In context, this transforms a nominally passive screenshot tool into a system capable of acting on sensitive personal data and communicating with external parties.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill captures screenshots, performs content recognition, and elsewhere documents sharing data outward, yet it provides no clear warning about privacy, personal data exposure, or downstream sharing risk. In a hiring context, screenshots may contain resumes, chats, phone numbers, or other regulated personal information.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation broadens the skill from screenshot capture into end-to-end recruitment automation, including outreach, resume handling, and enterprise chat usage. This hidden expansion materially changes the trust boundary and can lead to unauthorized actions on sensitive candidate data and external communications.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instructions include cross-application data movement from BOSS直聘 into enterprise chat and other recruiting workflow actions unrelated to simple window capture. This creates a clear privacy and data-handling risk because candidate information may be copied, shared, or acted on outside the original application without adequate controls.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Natural-language steps instruct the operator to copy recruiting data from BOSS直聘 into enterprise chat, which is a direct data exfiltration pathway for sensitive candidate information. In this context, the skill is more dangerous because it handles resumes, chat messages, and personal identifiers that may be subject to privacy obligations.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill metadata says it should only recognize the BOSS直聘 desktop window and capture a screenshot, but this workflow defines a full end-to-end recruitment automation pipeline including outreach, screening, resume handling, calls, and offers. That scope expansion is dangerous because a user invoking a screenshot-related skill could unintentionally trigger high-impact external actions affecting candidates and business operations.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
These steps automate candidate communication, batch chats, WeChat exchange/group handling, phone contact, and offer sending, none of which are justified by the stated screenshot-only capability. In this context, the mismatch makes the skill more dangerous because it can perform real-world external actions on third parties under the guise of a passive capture tool.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Resume collection, printing, and marking introduce handling of sensitive personal data and candidate evaluation operations that are outside the declared screenshot function. In a screenshot skill, this is especially risky because it expands from passive viewing to storage, processing, and potentially discriminatory decision support involving personal information.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The workflow implements a full recruitment automation pipeline, including candidate outreach, resume collection, phone contact, and offer sending, which is far beyond the declared skill purpose of locating and screenshotting a BOSS直聘 desktop window. This scope mismatch is dangerous because a user or platform may authorize a narrowly scoped screenshot skill while the file actually drives broad, high-impact business actions and access to sensitive candidate data.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
These steps automate operational recruiting actions such as batch chatting candidates, exchanging WeChat, collecting and printing resumes, making phone calls, and sending offers. In the context of a skill advertised only as a desktop watcher/screenshot helper, this creates unauthorized capability expansion and exposes sensitive personal data and business workflows to automation without clear user consent or proper controls.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code materially exceeds the declared skill purpose of locating a BOSS直聘 window and returning a screenshot. It performs active UI automation, OCR extraction, metric collection, bulk greeting actions, and task recording, creating a capability mismatch that can mislead users and enable unauthorized account actions or data handling.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill includes generic click automation and bulk action logic that can drive the BOSS直聘 desktop app without granular user approval. In a recruiting/chat context, this can send unintended greetings, interact with candidates, and change account state at scale, creating both security and business-process risk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill saves screenshots of the BOSS直聘 window to disk without warning, and those screenshots may contain sensitive chat content, resumes, contact details, or other personal data. Silent capture and retention of this material significantly raises privacy, compliance, and insider-access risks.
- Content