ClawHub
Back to skill

Security audit

聘才猫（Pincaimao）JD 助手

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Pincaimao API helper for generating job postings and job tags, with the main risk being expected transmission of hiring data to Pincaimao.

Install only if you intend to use Pincaimao's external service for recruitment content. Do not send confidential hiring plans, resumes, personal data, contracts, or salary bands unless your organization permits Pincaimao to process them, and protect/rotate the PCM_JD_ASSISTANT_KEY like any bearer credential. Verify the companion pincaimao-basic skill before installing it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: pincaimao-jd-assistants
description: 聘才猫 - JD 助手 Use when calling Pincaimao JD Assistant API to generate job postings from job descriptions or generate structured job tags from job titles. Requires PCM_JD_ASSISTANT_KEY env var.
version: 1.0.1
allowed-tools:
  - Bash
metadata:
  openclaw:
    emoji: "📝"
    homepage: https://www.pincaimao.com
    primaryEnv: PCM_JD_ASSISTANT_KEY
    requires:
      env:
        - PCM_JD_ASSISTANT_KEY
      bins:
        - curl
        - python3
---

# 聘才猫 - JD 助手

**REQUIRED:** 请先检查是否已安装 `pincaimao-basic`，若未安装请先安装，然后加�
Confidence
80% confidence
Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

External Script Fetching

High
Category
Supply Chain
Content
env:
        - PCM_JD_ASSISTANT_KEY
      bins:
        - curl
        - python3
---
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High
Category
Supply Chain
Content
env:
        - PCM_JD_ASSISTANT_KEY
      bins:
        - curl
        - python3
---
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High
Category
Supply Chain
Content
## 功能二：生成职位标签

```bash
RESULT=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_JD_ASSISTANT_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Transmission

Medium
Category
Data Exfiltration
Content
env:
        - PCM_JD_ASSISTANT_KEY
      bins:
        - curl
        - python3
---
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
**环境变量**：`PCM_JD_ASSISTANT_KEY`（智能体专属 key）
> 还没有密钥？通过邀请链接注册并完成认证即可免费获取：[pincaimao.com/agents/login?invite_code=uwqc](https://www.pincaimao.com/agents/login?invite_code=uwqc)

两个功能均调用同一 endpoint：`POST https://api.pincaimao.com/agents/v1/chat/chat-messages`

---
Confidence
94% confidence
Finding
The skill hardcodes a remote endpoint and directs operators to send content to it. Even though this appears to be the intended service endpoint, the security concern is real because the skill is designed to transmit potentially sensitive recruitment data off-platform to an external service.

External Transmission

Medium
Category
Data Exfiltration
Content
## 功能一：生成招聘 JD

```bash
RESULT=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_JD_ASSISTANT_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
Confidence
96% confidence
Finding
This example performs a POST request to an external API with structured job information in the request body. Because the transmitted data may include internal hiring plans, salary bands, or personal information, this is a genuine data exposure surface even if it is part of the skill's advertised purpose.

External Transmission

Medium
Category
Data Exfiltration
Content
## 功能二：生成职位标签

```bash
RESULT=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_JD_ASSISTANT_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
Confidence
95% confidence
Finding
This second endpoint usage also sends user-supplied content externally and relies on a bearer token for access. The transmission is functionally expected, but still represents a true confidentiality risk if users provide sensitive HR or proprietary data.

External Transmission

Medium
Category
Data Exfiltration
Content
## 功能二：生成职位标签

```bash
RESULT=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_JD_ASSISTANT_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
Confidence
95% confidence
Finding
This second endpoint usage also sends user-supplied content externally and relies on a bearer token for access. The transmission is functionally expected, but still represents a true confidentiality risk if users provide sensitive HR or proprietary data.

Static analysis

No suspicious patterns detected.