Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed interview-practice skill that fetches question material from GitHub and may store local profile feedback, with no evidence of deception, exfiltration, persistence backdoors, or destructive behavior.
Install this only if you are comfortable with an interview assistant using your technical tags and answers to generate scoring feedback, storing a local profile when you do not choose anonymous mode, and fetching question material from GitHub or other web sources for frontier topics. Review the host's actual tool permissions if you want to restrict network access or profile storage.
This mismatch specifically calls out subprocess-based fetching of GitHub content and the absence of several promised safety and workflow constraints. Hidden external resource access plus undocumented execution mechanisms materially raises risk because data may leave the local context and the agent may exercise more capability than users were told.
This mismatch specifically calls out subprocess-based fetching of GitHub content and the absence of several promised safety and workflow constraints. Hidden external resource access plus undocumented execution mechanisms materially raises risk because data may leave the local context and the agent may exercise more capability than users were told.
The skill declares multiple external/tool capabilities in documentation, including web retrieval and database operations, but does not define an explicit tool scope such as allowed-tools or permissions. This creates an authorization ambiguity where a host agent may permit broader network or shell access than users expect, increasing the chance of unintended external access or command execution paths.
The manifest description and all invocation phrases are presented only in Chinese, implying the skill operates in a fixed language. There is no opt-in language selection or stated regional constraint justifying the locale restriction, which matches the language-policy violation criteria.
The workflow persists interview feedback and updates a user profile, but the description does not prominently warn users before collection and storage occur. This undermines informed consent and may expose sensitive career or performance data to retention and later reuse without the user's clear understanding.
The privacy section states profile data is stored locally, but the skill also retrieves content from external web/GitHub sources. Even if only topic tags are sent externally, the documentation creates a misleading local-only expectation, which can cause users to reveal sensitive professional information under false assumptions about data exposure.
The skill describes external content retrieval without warning that user-supplied tags or topics may be transmitted to third-party services or repositories. This can leak a user's technical interests, employer-specific job requirements, or interview focus areas, especially in a professional context where such metadata may be sensitive.
The skill retrieves remote content from GitHub at runtime, but that capability is not clearly reflected in the described interview workflow. Hidden or under-disclosed network access is risky because remote content can change over time, influence prompts or interview questions, and expand the skill's data-flow/trust boundary beyond what users and reviewers expect.
Launching curl as an external subprocess gives the skill stronger execution capability than is necessary for a simple interview assistant and increases the attack surface. Even without shell injection here, subprocess use can bypass expected library-level controls, complicate sandboxing, and make future changes more dangerous if inputs become user-controlled.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
url = f"{GITHUB_RAW_BASE}/{quote(path)}"
try:
result = subprocess.run(
["curl", "-s", "-L", url],
capture_output=True,
text=True,
The function sends user-provided search keywords to an external GitHub-backed retrieval script without any user-facing disclosure or consent flow. In an interview assistant, keywords may include sensitive resume details, employer names, or proprietary tech stacks, so silent network transmission can leak user data outside the local environment.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
return []
try:
result = subprocess.run(
["python3", script_path, keyword, "--questions", "--limit", str(limit), "--json"],
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
return []
try:
result = subprocess.run(
["python3", script_path, "--random", "--questions", "--limit", str(count), "--json"],
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
return {}
try:
result = subprocess.run(
["python3", script_path, "--list-categories"],
capture_output=True,
text=True,
Although web_search currently returns an empty list, the code and generated question objects instruct the surrounding agent workflow to use an external web_fetch capability for frontier questions, again without any disclosure or consent boundary. In this skill context, prompts and tags can easily contain user-specific interests or background information, making unintended outbound queries a real privacy concern.
generate_report 的文档说明其根据“每题的得分列表”生成面试报告，但详情部分使用的是 final_score 字段，而本文件评分函数返回的是 round_score，没有生成 final_score。这使得报告中各题详情会显示 0 分或与真实得分不符，与函数宣称的行为相矛盾。
The privacy policy says '仅收集技术标签和面试表现数据', implying only technical tags and interview performance are collected. However, the workflow explicitly asks for the user's name and queries/stores profile records by name for non-anonymous users, which contradicts the stated minimal collection claim.
The file's docstring, help text, and user-facing output are written exclusively in Chinese, and the script does not provide any option to select another language or opt in to this locale. Under the policy for natural-language violations, forcing a specific language without user choice is reportable unless clearly justified as region-specific.
The module description and activation example are written entirely in Chinese, including the trigger phrase '我要开始模拟面试', which implies the skill expects a specific language. There is no indication that users may choose another language or locale, so this is a natural-language policy issue under the language/locale rule.
No suspicious patterns detected.