ClawHub
Back to skill

Security audit

聘才猫（Pincaimao）面试出题大师

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned but needs review because it uploads sensitive resume data and requires installing an unspecified companion skill.

Review before installing. Only use it if you trust Pincaimao with resumes and job descriptions, understand that uploaded files are stored remotely, and can verify the exact source of `pincaimao-basic` before allowing any installation or loading. Prefer explicit approval before each upload of candidate materials.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:22
Finding

Mandatory Unpinned Dependency Installation Creates a Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:66
Finding

User-Controlled Values Are Interpolated into JSON Without Escaping

Content
View full analysis
Remediation
View remediation
request.json import json import os payload = { "query": os.environ["QUERY"], "inputs": { "job_info": os.environ["JOB_INFO"], "file_url": os.environ["COS_KEY"], "job_title": os.environ["JOB_TITLE"], "question_number": 6, "can_outputAnalysis": "false", }, "response_mode": "blocking", } with open("request.json", "w", encoding="utf-8") as output: json.dump(payload, output, ensure_ascii=False) PY curl --fail-with-body -sS \ -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \ -H "Authorization: Bearer $PCM_INTERVIEW_QUESTIONS_KEY" \ -H 'Content-Type: application/json' \ --data-binary @request.json ``` The request file should be created with restrictive permissions and removed immediately after use, or the serialized body should be streamed directly to `curl` to avoid retaining sensitive data. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: pincaimao-interview-question
description: 聘才猫 - 面试出题大师 Use when calling Pincaimao Interview Question Master API to generate interview questions based on a job description and candidate resume. Requires PCM_INTERVIEW_QUESTIONS_KEY env var.
version: 1.0.1
allowed-tools:
  - Bash
metadata:
  openclaw:
    emoji: "❓"
    homepage: https://www.pincaimao.com
    primaryEnv: PCM_INTERVIEW_QUESTIONS_KEY
    requires:
      env:
        - PCM_INTERVIEW_QUESTIONS_KEY
      bins:
        - curl
        - python3
---

# 聘才猫 - 面试出题大师

**REQUIRED:** 请先检查是否已安装 `pincaimao-basic`，�

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
JOB_TITLE="高级销售专员"

# Step 1: 上传简历
UPLOAD=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/files/upload' \
  -H "Authorization: Bearer $PCM_INTERVIEW_QUESTIONS_KEY" \
  -F "file=@$RESUME_FILE")
COS_KEY=$(echo "$UPLOAD" | python3 -c "import sys,json; print(json.load(sys.stdin)['cos_key'])")

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
# Step 2: 生成面试题
QUERY=$(echo "$JOB_INFO" | cut -c1-20)
curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_INTERVIEW_QUESTIONS_KEY" \
  -H 'Content-Type: application/json' \
  -d "{

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The file upload step transmits the entire resume document to api.pincaimao.com and stores it in remote cloud object storage. Because resumes often contain highly sensitive personal information, this external transmission creates meaningful privacy and compliance risk if performed without informed consent or data minimization.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
JOB_TITLE="高级销售专员"

# Step 1: 上传简历
UPLOAD=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/files/upload' \
  -H "Authorization: Bearer $PCM_INTERVIEW_QUESTIONS_KEY" \
  -F "file=@$RESUME_FILE")
COS_KEY=$(echo "$UPLOAD" | python3 -c "import sys,json; print(json.load(sys.stdin)['cos_key'])")

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This call sends structured candidate-evaluation inputs to an external AI endpoint, including job information, uploaded file reference, and other parameters. In the context of an interview-question skill, the transmission is expected, but it still represents a real privacy-sensitive outbound flow to a third party.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
# Step 2: 生成面试题
QUERY=$(echo "$JOB_INFO" | cut -c1-20)
curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_INTERVIEW_QUESTIONS_KEY" \
  -H 'Content-Type: application/json' \
  -d "{

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This call sends structured candidate-evaluation inputs to an external AI endpoint, including job information, uploaded file reference, and other parameters. In the context of an interview-question skill, the transmission is expected, but it still represents a real privacy-sensitive outbound flow to a third party.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
# Step 2: 生成面试题
QUERY=$(echo "$JOB_INFO" | cut -c1-20)
curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_INTERVIEW_QUESTIONS_KEY" \
  -H 'Content-Type: application/json' \
  -d "{

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The Security & Privacy section narrows the transmitted data to resume files, job descriptions, and contract text, but the request example clearly includes additional fields such as job_title, question_number, and can_outputAnalysis. This is a documentation-to-behavior contradiction rather than a mere omission because it specifically describes what data is transmitted.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.