Security audit

聘才猫（Pincaimao）职业规划助手 v2

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed career-planning API helper that uploads a user-selected resume to Pincaimao and returns advice, with privacy risk that users should understand before use.

Install only if you are comfortable sending the selected resume and career advice request to Pincaimao for processing and storage. Use a dedicated API key, avoid uploading resumes with unnecessary sensitive details, and confirm the exact file before running the skill.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: pincaimao-career-planning-v2 description: 聘才猫 - 职业规划助手 V2 Use when calling Pincaimao Career Planning Assistant V2 API to generate career advice based on a resume and advice type. Requires PCM_CAREER_PLANNING_KEY env var. version: 1.0.1 allowed-tools: - Bash metadata: openclaw: emoji: "🚀" homepage: https://www.pincaimao.com primaryEnv: PCM_CAREER_PLANNING_KEY requires: env: - PCM_CAREER_PLANNING_KEY bins: - curl - python3 --- # 聘才猫 - 职业规划助手 V2 **REQUIRED:** 请先检查是否已安装 `pincaimao-basic`，若未安装请先安�

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
ADVICE_TYPE="晋升路径" # 初入职场 | 转型建议 | 晋升路径 # Step 1: 上传简历 UPLOAD=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/files/upload' \ -H "Authorization: Bearer $PCM_CAREER_PLANNING_KEY" \ -F "file=@$RESUME_FILE") COS_KEY=$(echo "$UPLOAD" | python3 -c "import sys,json; print(json.load(sys.stdin)['cos_key'])")

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
COS_KEY=$(echo "$UPLOAD" | python3 -c "import sys,json; print(json.load(sys.stdin)['cos_key'])") # Step 2: 生成职业建议 curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \ -H "Authorization: Bearer $PCM_CAREER_PLANNING_KEY" \ -H 'Content-Type: application/json' \ -d "{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The example uploads a local resume file to https://api.pincaimao.com/agents/v1/files/upload, which transfers potentially highly sensitive PII outside the agent boundary. Even though this is expected functionality, it creates a genuine privacy and confidentiality risk if used without strong user awareness and data-handling controls.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
ADVICE_TYPE="晋升路径" # 初入职场 | 转型建议 | 晋升路径 # Step 1: 上传简历 UPLOAD=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/files/upload' \ -H "Authorization: Bearer $PCM_CAREER_PLANNING_KEY" \ -F "file=@$RESUME_FILE") COS_KEY=$(echo "$UPLOAD" | python3 -c "import sys,json; print(json.load(sys.stdin)['cos_key'])")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: This network call transmits career-planning inputs and authentication to an external service, extending trust to a third-party processor. In context this is the core purpose of the skill, so it is not stealthy or clearly malicious, but it remains a true outbound data transmission risk involving sensitive employment data.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
COS_KEY=$(echo "$UPLOAD" | python3 -c "import sys,json; print(json.load(sys.stdin)['cos_key'])") # Step 2: 生成职业建议 curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \ -H "Authorization: Bearer $PCM_CAREER_PLANNING_KEY" \ -H 'Content-Type: application/json' \ -d "{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: This network call transmits career-planning inputs and authentication to an external service, extending trust to a third-party processor. In context this is the core purpose of the skill, so it is not stealthy or clearly malicious, but it remains a true outbound data transmission risk involving sensitive employment data.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
COS_KEY=$(echo "$UPLOAD" | python3 -c "import sys,json; print(json.load(sys.stdin)['cos_key'])") # Step 2: 生成职业建议 curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \ -H "Authorization: Bearer $PCM_CAREER_PLANNING_KEY" \ -H 'Content-Type: application/json' \ -d "{