Security audit

Career Companion

Security checks for vulnerabilities and agentic risk

Overview

This career-search skill is mostly coherent, but it gives the agent Bash-based web request instructions with unsafe user-value interpolation and no clear trust boundary for external job-description content.

Install only if you are comfortable with a career assistant that can run Bash curl commands for job searches. Before use, avoid sharing unnecessary resume PII, verify job links and advice yourself, and treat fetched job descriptions as untrusted text. The publisher should replace shell interpolation with a structured HTTP client or explicit URL-encoding and add privacy and prompt-injection guardrails.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:32
Finding: Shell Command Injection Through Unvalidated URL Interpolation
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:66
Finding: Indirect Prompt Injection Through Untrusted Job-Description HTML
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
curl -s "https://zerogtalent.com/api/jobs/search?employmentType=internship&remote=true&q=AI&limit=10"

text
### Output rules Users read these results on mobile (Telegram, Slack, etc.) where long messages get truncated and lose formatting. To keep results scannable and consistent:

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description contains very broad trigger phrases such as jobs, careers, hiring, salary, and company mentions, which can cause the skill to activate for many ordinary conversations that may not require this workflow. Over-broad activation increases the chance the agent will unnecessarily invoke external search behavior or request sensitive career data like resumes in contexts where the user did not clearly ask for it.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to read, critique, and tailor user resumes, which commonly contain personal data such as name, email, phone number, work history, education, and location, but it provides no privacy guardrails. Without data-minimization guidance, redaction prompts, or retention limits, the skill may encourage unnecessary collection and processing of sensitive personal information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The API reference states that the job description is returned as HTML but does not warn that this content is untrusted and must not be rendered without sanitization. In a career assistant context, downstream tooling may display scraped job descriptions in chat, previews, or resume-tailoring workflows, creating a realistic path to stored or reflected XSS if HTML is injected into a web UI.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.