ClawHub
Back to skill

Security audit

聘才猫（Pincaimao）职业规划助手 v2

Security checks across malware telemetry and agentic risk

Overview

This appears to be a resume-based career advice skill that sends the user-selected resume and related inputs to a disclosed third-party API, which is sensitive but aligned with its purpose.

Install only if you are comfortable sending resume contents to api.pincaimao.com. Redact unnecessary personal details first, use a dedicated API key, and verify the resume path before invoking the skill.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Content
COS_KEY=$(echo "$UPLOAD" | python3 -c "import sys,json; print(json.load(sys.stdin)['cos_key'])")

# Step 2: 生成职业建议
curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_CAREER_PLANNING_KEY" \
  -H 'Content-Type: application/json' \
  -d "{
Confidence
92% confidence
Finding
curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \ -H "Authorization: Bearer $PCM_CAREER_PLANNING_KEY" \ -H 'Content-Type: application/json' \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
ADVICE_TYPE="晋升路径"  # 初入职场 | 转型建议 | 晋升路径

# Step 1: 上传简历
UPLOAD=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/files/upload' \
  -H "Authorization: Bearer $PCM_CAREER_PLANNING_KEY" \
  -F "file=@$RESUME_FILE")
COS_KEY=$(echo "$UPLOAD" | python3 -c "import sys,json; print(json.load(sys.stdin)['cos_key'])")
Confidence
96% confidence
Finding
https://api.pincaimao.com/

External Transmission

Medium
Category
Data Exfiltration
Content
COS_KEY=$(echo "$UPLOAD" | python3 -c "import sys,json; print(json.load(sys.stdin)['cos_key'])")

# Step 2: 生成职业建议
curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_CAREER_PLANNING_KEY" \
  -H 'Content-Type: application/json' \
  -d "{
Confidence
92% confidence
Finding
https://api.pincaimao.com/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.