Cruit Candidate

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:36 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its Cruit profile purpose, but it needs review because mutable remote instructions and unverified remote installation can change what agents run after approval.

Review before installing. Prefer a marketplace-reviewed package or download and inspect the installer instead of running curl | sh. Install only if you are comfortable with Cruit storing a local access token and config, reading only folders you approve plus an optional resume, publishing approved profile data to cruit.dev, and optionally running weekly refresh automation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:13

Finding

Unverified Remote Installer Executed Directly by a Shell

Content

View full analysis

Remediation

View remediation

install.sh' | sha256sum -c - sh install.sh ``` 5. Prefer signing release artifacts with Sigstore, minisign, or another established signing mechanism and document signature verification. 6. Encourage users to inspect the downloaded script before running it. 7. Prefer installation through a marketplace or package mechanism that binds the installation to the reviewed, immutable package. 8. Apply least privilege during installation and explicitly state that elevated execution, such as `sudo`, must not be used. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:7

Finding

Audited Skill Behavior Is Overridden by Mutable Remote Instructions on Every Run

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: install.sh:4

Finding

Installer Replaces Agent Skill Files from an Unverified and Redirectable Source

Content

View full analysis

/dev/null 2>&1; then curl -fsSL "$url" -o "$out" elif command -v wget >/dev/null 2>&1; then wget -qO "$out" "$url" else echo "Install failed: curl or wget is required." >&2 exit 1 fi } ``` ```sh install_skill() { dest="$1" mkdir -p "$dest" download "$BASE_URL/skills/candidate/SKILL.md" "$dest/SKILL.md" download "$BASE_URL/skills/candidate/INSTRUCTIONS.md" "$dest/INSTRUCTIONS.md" chmod 700 "$dest" chmod 600 "$dest/SKILL.md" "$dest/INSTRUCTIONS.md" test -f "$dest/SKILL.md" test -f "$dest/INSTRUCTIONS.md" printf '%s\n' "$dest/SKILL.md" >> "$verified" printf '%s\n' "$dest/INSTRUCTIONS.md" >> "$verified" } while IFS='|' read -r label kind path; do [ -n "$label" ] || continue case "$kind" in skill) install_skill "$path" ;; esac done < "$plan" ``` ### Technical Analysis The installer downloads `SKILL.md` and `INSTRUCTIONS.md` directly into user-level Agent Skill directories. Its verification consists only of checking that the files exist. It does not verify a signature, expected digest, release version, schema, or equivalence to the files contained in the audited package. The source can also be changed through `CRUIT_SITE_BASE` or `--site-base`. Documentation explicitly allows a plain-HTTP localhost origin for development. Although deliberately configuring an alternate source is a supported development feature rather than an independent attack, environment inheritance or operator error could cause untrusted instructions to be installed. The destination files are instruction-bearing components loaded by supported coding agents. Replacing them is security-sensitive even though they are Markdown rather ...[truncated 1841 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (24)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTRUCTIONS.md (reported line 124)May include surrounding context.

7. Set weekly refresh

I’ll review only the project folders you approve and, if you provide one, your resume. I won’t publish source code, secrets, .env files, email addresses, phone numbers, street addresses, or private contact details. Before anything goes live, I’ll show you the profile in chat for approval.

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

7. Set weekly refresh

I’ll review only the project folders you approve and, if you provide one, your resume. I won’t publish source code, secrets, .env files, email addresses, phone numbers, street addresses, or private contact details. Before anything goes live, I’ll show you the profile in chat for approval.

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The skill instructs the agent to write a bearer access token into ~/.cruit/credentials.json, which creates a sensitive local secret that could be exposed through weak filesystem protections, backups, logs, or other local compromise. Although the intent is legitimate session persistence, storing long-lived tokens in a plain JSON file increases the blast radius if the host or workspace is later accessed by another process or user.

Content

Scanner excerpt · INSTRUCTIONS.md (reported line 162)May include surrounding context.

Poll at the returned interval while the response is {"status":"authorization_pending"}.

6. When you receive an access token, write:

   json

   { "access_token": "...", "apiBase": "https://cruit.dev" }
   

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The README instructs users to fetch a remote shell script over the network and immediately execute it via sh. This is dangerous because any compromise of cruit.dev, its hosting/CDN, TLS termination, or the script supply chain would result in arbitrary code execution on the user's machine with the user's privileges, and the user has no opportunity to inspect the script before execution.

Content

Scanner excerpt · README.md (reported line 13)May include surrounding context.

Install

sh

curl -fsSL https://cruit.dev/skills/candidate/install.sh | sh

For direct marketplace installs, use this folder as the package root.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | sh pipeline removes any inspection barrier and directly turns downloaded content into executed shell commands. In the context of an agent skill, this is more dangerous because users may follow setup instructions automatically or semi-automatically, increasing the chance of silent remote code execution if the upstream content changes or is malicious.

Content

Scanner excerpt · README.md (reported line 13)May include surrounding context.

Install

sh

curl -fsSL https://cruit.dev/skills/candidate/install.sh | sh

For direct marketplace installs, use this folder as the package root.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTRUCTIONS.md (reported line 56)May include surrounding context.

md

The skill uses Cruit's browser device-auth flow. It must never ask the user to paste a
token, password, API key, auth cookie, or secret.

Credentials are stored locally at `~/.cruit/credentials.json` with user-only file
permissions.

## Data Handling

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 20)May include surrounding context.

md

The skill uses Cruit's browser device-auth flow. It must never ask the user to paste a
token, password, API key, auth cookie, or secret.

Credentials are stored locally at `~/.cruit/credentials.json` with user-only file
permissions.

## Data Handling

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill is for creating and maintaining a Cruit candidate profile and handling profile publication/refresh workflows. The supplied code does not perform any profile management actions. Instead, it is an installer script whose primary purpose is to place Cruit skill files into user-level directories for supported coding agents. This is a materially different purpose and includes undeclared capabilities such as local environment detection, remote file download, directory creation, and file permission changes. While installation could be a supporting setup step for a broader profile workflow, this specific code chunk itself is not implementing the declared candidate-profile functionality, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

---

<!-- BEGIN SNAPSHOT — offline fallback only. Generated from candidate/INSTRUCTIONS.md.
     Keep in sync on every release; the URL above is the source of truth. -->

You are an AI coding agent helping the user create and maintain their Cruit candidate

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The skill explicitly defines a path for persistent credential storage and later instructs the agent to read and use those credentials automatically. Any skill that stores bearer tokens locally creates a high-value target for token theft, misuse by other local processes, or unintended reuse across sessions if file protections are weak or the environment is shared.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

text

CRUIT_API_BASE = https://cruit.dev
CRED_PATH      = ~/.cruit/credentials.json
CONFIG_PATH    = ~/.cruit/config.json

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill instructs the agent to write an access token directly to a local JSON file. Bearer tokens grant account access without additional proof, so plaintext persistence materially increases the risk of account compromise if the host, filesystem, logs, backups, or other tools are exposed.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

Poll at the returned interval while the response is {"status":"authorization_pending"}.

6. When you receive an access token, write:

   json

   { "access_token": "...", "apiBase": "https://cruit.dev" }
   

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTRUCTIONS.md (reported line 3)May include surrounding context.

md

# Cruit — Candidate Skill

You are an AI coding agent helping the user create and maintain their Cruit candidate
profile. Cruit is a hiring platform for AI-native developers. Your job is to turn the
user's approved project history and optional resume into a complete, accurate,
recruiter-searchable profile.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · INSTRUCTIONS.md (reported line 170)May include surrounding context.

md

to `CRED_PATH`. Create `~/.cruit/` if needed and use user-only file permissions.

Do not ask the user to paste tokens, passwords, API keys, or auth cookies.

### STEP 3 — Confirm project scope

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

md

to `CRED_PATH`. Create `~/.cruit/` if needed and use user-only file permissions.

Do not ask the user to paste tokens, passwords, API keys, or auth cookies.

### STEP 3 — Confirm project scope

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SECURITY.md (reported line 17)May include surrounding context.

md

## Authentication

The skill uses Cruit's browser device-auth flow. It must never ask the user to paste a
token, password, API key, auth cookie, or secret.

Credentials are stored locally at `~/.cruit/credentials.json` with user-only file

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill directs the agent to perform network access, filesystem writes, and credential handling, but the manifest declares no explicit tool scope or allowed-tools. In a skill system that relies on manifest scoping for least privilege and user review, this can cause the skill to run with broader capabilities than users expect.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The skill is explicitly designed to maintain a persistent candidate profile and set up weekly refresh behavior, including saving local state for future runs. Persistent state and recurring automation expand the blast radius of any mistaken scope choice, stale consent, or compromised credentials because the skill can continue acting on stored approvals over time.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: cruit-candidate
description: Create and maintain a Cruit candidate profile for an AI-native developer. Use when the user wants to join Cruit, publish a candidate profile, refresh their Cruit profile, or set up weekly profile updates for recruiter discovery.
---

# Cruit — Candidate Skill

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The setup disclosure emphasizes privacy around published data but does not upfront warn that access tokens and configuration will be persisted locally. Users may consent to profile setup without understanding that long-lived credentials and profile metadata will be written to disk for future automation.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · install.sh (reported line 197)May include surrounding context.

sh

install_skill() {
  dest="$1"
  mkdir -p "$dest"
  download "$BASE_URL/skills/candidate/SKILL.md" "$dest/SKILL.md"
  download "$BASE_URL/skills/candidate/INSTRUCTIONS.md" "$dest/INSTRUCTIONS.md"
  chmod 700 "$dest"
  chmod 600 "$dest/SKILL.md" "$dest/INSTRUCTIONS.md"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 199)May include surrounding context.

sh

mkdir -p "$dest"
  download "$BASE_URL/skills/candidate/SKILL.md" "$dest/SKILL.md"
  download "$BASE_URL/skills/candidate/INSTRUCTIONS.md" "$dest/INSTRUCTIONS.md"
  chmod 700 "$dest"
  chmod 600 "$dest/SKILL.md" "$dest/INSTRUCTIONS.md"
  test -f "$dest/SKILL.md"
  test -f "$dest/INSTRUCTIONS.md"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 200)May include surrounding context.

sh

download "$BASE_URL/skills/candidate/SKILL.md" "$dest/SKILL.md"
  download "$BASE_URL/skills/candidate/INSTRUCTIONS.md" "$dest/INSTRUCTIONS.md"
  chmod 700 "$dest"
  chmod 600 "$dest/SKILL.md" "$dest/INSTRUCTIONS.md"
  test -f "$dest/SKILL.md"
  test -f "$dest/INSTRUCTIONS.md"
  printf '%s\n' "$dest/SKILL.md" >> "$verified"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · submission-copy/marketplace-listings.md (reported line 13)May include surrounding context.

md

## Short Description

Create a privacy-respecting Cruit profile for AI-native developer discovery. Reviews only
approved project folders, drafts a recruiter-searchable profile, and publishes after user
approval.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 12)May include surrounding context.

text

to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description says to use the skill when the user wants to 'refresh their Cruit profile' or 'set up weekly profile updates,' but it does not clearly distinguish this skill from more general profile-editing or job-search assistance. The trigger scope is fairly broad and lacks negative examples or explicit boundaries, which could cause unintended invocation in adjacent contexts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.