iHRFlow HR Assistant

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:17 AM UTC
• Version: 1.0.0

Overview

This HR skill is mostly coherent, but it handles credentials and live candidate records with enough scoping and session-safety gaps that users should review it carefully before installing.

Install only in a trusted OpenClaw environment for authorized HR users. Treat IHRFLOW_MCP_URL as a security boundary, prefer a fixed HTTPS endpoint, avoid shared hosts, and require human confirmation before any action that changes candidate status, schedules interviews, publishes positions, or writes notes. Consider fixing the session-file handling before production use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mcp-call.sh:16

Finding

Predictable and Insufficiently Protected MCP Session File

Content

View full analysis

"$SESSION_FILE" fi ``` ### Technical Analysis The MCP session identifier is stored in a fixed, predictable path under the system-wide `/tmp` directory. The filename depends only on the current username and does not distinguish between MCP endpoints, tenants, OpenClaw instances, or concurrent conversations. The script does not set a restrictive `umask`, explicitly assign mode `0600`, verify ownership, reject symbolic links, or create the session file atomically. With a common process umask of `022`, shell redirection can create the file with mode `0644`, allowing other local users to read the session identifier. There is also a time-of-check/time-of-use window between `rm -f "$SESSION_FILE"` and the later shell redirection. The redirection follows symbolic links if one is introduced during that window. In addition, all processes running under the same account share the same session file, which can cause one Skill invocation t ...[truncated 1996 chars]

Remediation

View remediation

"$tmp_session" mv -f "$tmp_session" "$SESSION_FILE" ``` 4. Before reading the file, verify that it is a regular file, is owned by the effective user, is not a symbolic link, and has no group or world permissions. 5. Isolate sessions by endpoint, tenant, and process or OpenClaw instance. Do not use one username-derived file for every invocation. 6. Register cleanup handlers and remove session material when it is no longer required: ```bash trap 'rm -rf "$SESSION_DIR"' EXIT HUP INT TERM ``` 7. Consider keeping the session identifier in process memory when persistence across separate script invocations is not strictly required. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mcp-call.sh:17

Finding

Authentication Credentials Can Be Sent to an Untrusted or Plaintext Endpoint

Content

View full analysis

/dev/null ``` ```bash cmd_login() { local username="${IHRFLOW_USERNAME:?IHRFLOW_USERNAME is not set}" local password="${IHRFLOW_PASSWORD:?IHRFLOW_PASSWORD is not set}" local tenant_id="${IHRFLOW_TENANT_ID:-}" if [[ ! -f "$SESSION_FILE" ]]; then cmd_init >/dev/null fi local args args=$(jq -n \ --arg u "$username" \ --arg p "$password" \ --arg t "$tenant_id" \ 'if $t == "" then {username:$u, password:$p} else {username:$u, password:$p, tenant_id:$t} end') _call_tool "login" "$args" } ``` ```bash local raw raw=$(curl -s -X POST "$MCP_URL" \ "${headers_arr[@]}" \ -d "$body" 2>/dev/null) ``` ### Technical Analysis The Skill obtains the endpoint entirely from `IHRFLOW_MCP_URL` and passes it directly to `curl`. It does not require HTTPS, validate the destination host, constrain permitted URL schemes, or require explicit approval for a custom endpoint. The login request contains the configured iHRFlow username and password and may also contain a tenant identifier. `_common_headers` additionally sends `IHRFLOW_API_KEY`, when configured, to the same endpoint. Credential transmission is necessary for the declared iHRFlow authentication functionality. The security issue is not the use of these named credentials itself, but the lack of validation around where and how they are transmitted. The README recommends the legitimate HTTPS endpoint, but this recommendation is not enforced by the executable script. If configuration is modified to use an `http://` endpoint, credentials and HR data ...[truncated 1944 chars]

Remediation

View remediation

&2 exit 1 } ;; *) echo "IHRFLOW_MCP_URL must use HTTPS" >&2 exit 1 ;; esac ``` 2. Restrict `curl` to secure protocols and prevent redirects from downgrading transport: ```bash curl \ --proto '=https' \ --proto-redir '=https' \ --fail-with-body \ --connect-timeout 10 \ --max-time 60 \ ... ``` 3. If self-hosted endpoints are supported, require an explicit trusted-host configuration rather than silently accepting any host. For a fixed hosted service, enforce an allowlist such as `ihrflow.com`. 4. Do not disable TLS certificate verification. For private certificate authorities, support a specific CA bundle through `--cacert` rather than using `-k`. 5. Separate endpoint configuration from secret configuration and protect both against modification by untrusted Skills or users. 6. Document that `IHRFLOW_MCP_URL` is a security-sensitive trust boundary and that changing it discloses credentials to the selected server. 7. Prefer per-Skill secret injection or a secret vault over a global `~/.openclaw/.env`. The audited code does not directly scan or read that file; it only consumes the specifically named environment variables. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/用户手册.md (reported line 416)May include surrounding context.

md

### 安全说明

- 你的密码和 API Key 在 OpenClaw 配置中加密存储，CLI 查询时显示为 `__OPENCLAW_REDACTED__`
- 如需更高安全性，可启用 OpenClaw 内置的 `apikeys-ui` Vault 技能，将敏感变量存入 `~/.openclaw/secrets.json`（权限 0600），配置中仅保留引用
- MCP 服务器支持 API Key 传输层认证 + 用户密码登录双重验证
- 每个用户的会话独立，JWT Token 自动管理和刷新
- 多租户数据完全隔离

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The markdown advertises tools that access resumes, search talent, add resume notes, submit interview feedback, and update hiring pipeline state, all of which affect sensitive candidate data or records. While examples sometimes show a follow-up question before recommending candidates, the README does not clearly warn users that the skill can read and modify HR data and should be used with appropriate authorization and care.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The invocation description is broad enough to activate the skill for many generic recruiting requests, increasing the chance that high-privilege actions are taken when a narrower, less-privileged skill or plain chat response would suffice. In an HR context with shell and network permissions plus write-capable actions like status updates, interview changes, and candidate recommendations, overbroad routing can lead to unintended access or modifications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Forcing interaction in Chinese without user choice can cause misunderstandings of confirmations, approvals, rejections, and scheduling changes, especially for multilingual users. In this skill, destructive or sensitive HR actions depend on accurate human understanding, so a language mandate raises the risk of accidental authorization or incorrect execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation encourages direct state-changing actions such as advancing candidates, rejecting applicants, scheduling interviews, and publishing jobs, but it does not clearly warn users that these commands affect live production hiring data. In an AI-driven interface, users may mistake exploratory or conversational prompts for harmless queries, increasing the risk of unintended workflow changes, candidate status corruption, or accidental business actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation exposes tools that retrieve full resume details and candidate records, which are highly sensitive HR/PII data, but it provides no privacy, authorization, minimization, or consent guidance. In a skill with network and shell permissions, normalizing access to resumes without explicit handling constraints increases the chance of inappropriate disclosure or misuse by downstream agents or users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill documents state-changing recruiting actions such as recommending candidates into a pipeline, but does not warn that these actions can materially affect candidate status and hiring workflows. Without confirmation, audit, or impact guidance, an agent could make irreversible or misleading workflow changes that affect applicants and recruiters.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mcp-call.sh (reported line 82)May include surrounding context.

sh

local headers_arr=()
  while IFS= read -r line; do headers_arr+=("$line"); done < <(_common_headers)

  curl -s -o "$bodyfile" -D "$headerfile" \
    -X POST "$MCP_URL" \
    "${headers_arr[@]}" \
    -d "$body" 2>/dev/null

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mcp-call.sh (reported line 106)May include surrounding context.

sh

# Send initialized notification (reload headers to include new session)
  local notify_headers=()
  while IFS= read -r line; do notify_headers+=("$line"); done < <(_common_headers)
  curl -s -X POST "$MCP_URL" \
    "${notify_headers[@]}" \
    -d "$(jq -n '{jsonrpc:"2.0",method:"notifications/initialized"}')" \
    >/dev/null 2>&1 || true

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script performs a credential-bearing login using environment-supplied username and password and sends them over the network without any user-facing disclosure, confirmation, or dry-run visibility. In an agent skill with network and shell permissions, this can cause silent transmission of sensitive credentials to a configured endpoint, especially if the endpoint is misconfigured, attacker-controlled, or unexpectedly triggered by a higher-level workflow.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This outbound tool invocation sends arbitrary JSON arguments to the remote MCP server, and in this skill context those arguments may include sensitive HR data, candidate information, or authentication-derived session context. Because the destination URL is entirely environment-controlled and there is no validation, consent, or data minimization, this creates a real exfiltration surface rather than merely harmless network use.

Content

Scanner excerpt · scripts/mcp-call.sh (reported line 150)May include surrounding context.

sh

while IFS= read -r line; do headers_arr+=("$line"); done < <(_common_headers)

  local raw
  raw=$(curl -s -X POST "$MCP_URL" \
    "${headers_arr[@]}" \
    -d "$body" 2>/dev/null)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The call and resource paths automatically initialize a session and log in if no session file exists, which means ordinary tool usage can silently trigger outbound authentication without the caller realizing it. This increases the risk of unintended credential use and data disclosure because a seemingly read-only or innocuous command can cause hidden network side effects.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This resource read sends attacker- or caller-controlled URIs to the remote MCP service and may retrieve or expose sensitive recruitment data through an unvalidated external endpoint. In an HR assistant context, the data involved can include candidate records or internal hiring information, so silent transmission to a configurable remote host materially increases confidentiality risk.

Content

Scanner excerpt · scripts/mcp-call.sh (reported line 210)May include surrounding context.

sh

while IFS= read -r line; do headers_arr+=("$line"); done < <(_common_headers)

  local raw
  raw=$(curl -s -X POST "$MCP_URL" \
    "${headers_arr[@]}" \
    -d "$body" 2>/dev/null)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The phrase 'Chinese interaction, English enum values' indicates a language constraint for interaction, but the document does not say users can choose another language or opt in to Chinese. This may violate language/locale policy guidance when a skill appears to force a specific language without user choice.

Content

No source excerpt is available for this finding.

Lp4

Low

• Category: MCP Least Privilege
• Confidence: 65% confidence

Finding

Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

SQP-3 applies to all file types, including markdown. The entire user-facing manual and all example invocations are Chinese-only, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking environment for compliance or regional reasons.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The reference primarily uses English documentation but includes Chinese-only response text and multiple Chinese-only example values, which can impose an implicit locale expectation on users. SQP-3 applies because the file does not explain the language behavior or offer a language/locale choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.