v1.0.1

聘才猫（Pincaimao）劳动合同卫士

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 8:25 AM.

Analysis

The skill is a coherent Pincaimao contract-analysis API wrapper, but it asks the agent to install/load an undeclared helper skill and sends sensitive contract data to an external service.

GuidanceBefore installing, review the separate `pincaimao-basic` dependency because it is required but not included or pinned here. If you proceed, use a dedicated Pincaimao API key and only submit labor contracts you are allowed to share with Pincaimao, since the content/files are transmitted externally and uploaded files are stored in Pincaimao COS.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityMediumConfidenceHighStatusConcern

SKILL.md

**REQUIRED:** 请先检查是否已安装 `pincaimao-basic`，若未安装请先安装，然后加载它了解通用接口（文件上传、鉴权、响应格式、SSE 解析模板）。

The skill requires installing and loading a separate helper skill that is not included in the reviewed file set and is not pinned to a source or version in the provided artifacts.

User impactUsing this skill may add or load another skill before the contract analysis runs, expanding the behavior beyond the reviewed SKILL.md.

RecommendationReview `pincaimao-basic` separately before installing, and prefer a version-pinned, declared dependency with clear user approval before any helper skill is installed or loaded.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

allowed-tools:
  - Bash

The skill permits Bash and documents `curl`/`python3` calls to the Pincaimao API. This is central to the API-wrapper purpose, but users should notice that the agent can run local commands to perform the upload/request flow.

User impactThe agent can execute command-line API calls as part of contract analysis, including uploading a user-selected file or sending pasted contract text.

RecommendationKeep use limited to the documented Pincaimao endpoints and verify the contract file/text before allowing it to be sent.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

API key is read from environment variable and passed via `Authorization` header; never hardcoded

The skill uses a bearer API key for Pincaimao access. This is expected for the integration and is disclosed, but it is still delegated account/API authority.

User impactAnyone or any agent process with access to `PCM_LABOR_CONTRACT_KEY` could make authenticated Pincaimao API calls within that key's permissions.

RecommendationUse a dedicated, least-privileged API key if available, store it securely, and rotate or revoke it if it may have been exposed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityMediumConfidenceHighStatusNote

SKILL.md

contract text are transmitted to `api.pincaimao.com` for AI processing
- Uploaded files are stored on Pincaimao's COS (Cloud Object Storage); returned `cos_key` paths should be treated as sensitive

The skill clearly discloses external transmission and remote storage of contract content/files, which is purpose-aligned but involves sensitive employment/legal data.

User impactLabor contracts may contain personal, salary, company, and legal terms that will leave the local environment and be stored by the provider.

RecommendationOnly submit contracts you are authorized to share, redact unnecessary personal or confidential details where possible, and review Pincaimao's retention/deletion terms.