Developer Interview Simulator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:16 AM UTC
• Version: 1.0.2

Overview

This interview-practice skill is mostly local and coherent, but it includes an unrelated unpinned npx command recommendation and broad triggers that warrant review before use.

Install only if you are comfortable with local storage of interview history and CV-derived profile fields. Avoid running `npx skills` from this skill's advice unless you independently verify the package and publisher; use a local skills directory check instead. Be aware that generic code-review requests may accidentally route into interview-style feedback.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:369

Finding

Unpinned Third-Party Package Execution Recommendation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 369–372
Vulnerability Type: Insecure third-party dependency execution
Risk Level: Medium

Complete Code Snippet:

markdown

**When the user asks "what skills do I have?" or "list my skills"**  
- You cannot list installed skills; suggest they run `npx skills` or check their skills directory. Stay focused on interview prep.

Technical Analysis

The Skill recommends running npx skills without identifying a trusted publisher, pinning a reviewed package version, or verifying package integrity. Depending on the local npm/npx configuration and cache state, npx can retrieve the named package from a configured package registry and execute its code with the invoking user's permissions.

Because package resolution occurs after this Skill has been reviewed, the effective executable payload can change independently of the audited project. This creates a supply-chain risk involving package compromise, registry substitution, dependency confusion, or unexpected resolution of a similarly named package.

The command is not necessary for the declared developer-interview simulation functionality. The Skill can instead direct users to inspect an existing local skills directory without downloading or executing third-party software. The recommendation therefore exceeds the minimum privileges required for its core purpose.

The audit did not find evidence that this command intentionally transmits CV content or other sensitive information. Elsewhere, the Skill explicitly prohibits external calls and requires local CV processing. The risk arises from the privileges available to arbitrary package lifecycle or executable code if the user follows this recommendation.

Attack Path

1. A user asks the Skill to list installed skills.
2. Following SKILL.md, the agent recommends that the user run npx skills.
3. The user executes the command.
4. If the package is not ...[truncated 928 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the npx skills recommendation because it is unrelated to interview simulation and is not required for the Skill's declared functionality.
2. Direct users to inspect their local skills directory using non-executable filesystem operations instead.
3. If a CLI is genuinely required, specify an official and verified package name and publisher.
4. Pin the package to an explicitly reviewed version rather than relying on mutable default resolution.
5. Verify package integrity through an approved lockfile or cryptographic integrity metadata.
6. Inform users clearly that the command may download and execute third-party code, and require explicit confirmation before suggesting execution.
7. Prefer installation and execution within a restricted environment that does not expose credentials, sensitive files, or unnecessary network access.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation rule uses broad 'says or implies' phrasing across many common interview-prep intents, which can cause the skill to trigger in contexts the user did not clearly request. In a skill that reads CV files and persists profile/history data, ambiguous activation increases the chance of unintended file access, data retention, or confusing behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill persists interview profile, history, weak areas, and optionally CV-derived data under a long-lived directory in the user's home folder. Persistent storage of potentially sensitive career information creates privacy risk if the data is retained without clear consent, shared across sessions unexpectedly, or accessed by other local processes/users.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

On first message, ensure data directory exists:

bash

mkdir -p ~/.openclaw/developer-interview-simulator

Initialize using these exact shapes:

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The phrase 'rate my solution' is not limited to developer interview context and could match many generic user requests. Without contextual constraints, it risks activating this skill outside its intended domain.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md

- **Storage:** `~/.openclaw/developer-interview-simulator/` only.
- **No external calls:** No APIs, no network, no data sent to any server.
- **Permissions:** `read`/`write` for profile, history, weak areas, saved answers; `read` for user-provided CV file (local path or pasted content); `exec` only for `mkdir -p` on first run.
- **CV data:** If the user provides a CV, parse it only to extract profile fields and tailor questions; do not send CV content anywhere. Optionally save extracted profile to `profile.json` with user confirmation.

---

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instruction treats 'review this code' as a trigger, but that phrase is common across many coding workflows and is not specific to interview simulation. This broad overlap increases the chance of accidental invocation when the user simply wants a normal code review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.