Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - ./references/salary_database.json
Security audit
career-planner-china
Security checks for vulnerabilities and agentic risk
Overview
This skill needs review because it promises neutral advice while favoring one insurer and gives conflicting instructions about saving personal information.
Treat insurer rankings as the publisher's preference. Keep email and memory features disabled until their conflicting instructions are resolved; before enabling them, confirm the report contents, recipient, storage location, and deletion options.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `references/salary_database.json` - 详细薪资数据库（覆盖各城市/行业/职业层级）
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **薪资/趋势/岗位查询** | 读取本地 `salary_database.json` / `industry_trends.md` | 离线查询，不联网 |
Insurance recommendations enforce preferential ordering despite the manifest's explicit promise of neutral, unprioritized information.
Medium
- Category
- Excessive Agency
- Confidence
- 99% confidence
- Finding
The manifest promises neutral information without preferential ordering, but the workflow explicitly prioritizes one insurance company across all regions despite describing its coverage as seven provinces. This can steer career decisions through recommendations presented as impartial; maintainer-declared priority_basis, verified flags, and a generic regulator URL do not independently establish suitability or justify ranking. The insurance-interest trigger and user-controlled contact disclosure limit unsolicited outreach, but do not resolve the recommendation-integrity issue.
- Content
The optional long-term memory workflow permits persistence outside the declared empty filesystem write permissions.
Medium
- Category
- Excessive Agency
- Confidence
- 95% confidence
- Finding
The skill declares an empty filesystem write allowlist while separately permitting requested long-term profile persistence through MEMORY.md or memory files. In a host that treats these declarations as documentation rather than enforced restrictions, an agent could retain personal career-assessment information outside the declared write boundary. Explicit user authorization and host-support conditions reduce the risk, and no actual permission bypass is demonstrated, but they do not reconcile the conflicting capability declarations.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
json "source_urls": [ "https://zhuanlan.zhihu.com/p/20258519416", "https://www.kunlunhealth.com.cn/artdetailNew/283", "https://data.eastmoney.com/gdfx/shareholder/76080009.html", "https://www.qcc.com/cmainmember/140d38d0c0420d8fd968a26e71ace3df" ], "source_url": "https://zhuanlan.zhihu.com/p/20258519416",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
json "source_urls": [ "https://zhuanlan.zhihu.com/p/20258519416", "https://www.kunlunhealth.com.cn/artdetailNew/283", "https://data.eastmoney.com/gdfx/shareholder/76080009.html", "https://www.qcc.com/cmainmember/140d38d0c0420d8fd968a26e71ace3df" ], "source_url": "https://zhuanlan.zhihu.com/p/20258519416",
Automatic report emailing lacks a privacy warning about third-party processing.
Medium
- Category
- Output Handling
- Confidence
- 94% confidence
- Finding
The AgentMail integration instructs automatic emailing after report generation, rather than merely listing an available tool. Although it identifies the email destination, it does not warn that report contents, potentially including personal career information, will be transmitted through a third-party service.
- Content