聘才猫（Pincaimao）在线面试

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:43 AM UTC
• Version: 1.0.1

Overview

This skill is mostly aligned with an online interview API, but it under-discloses sensitive report callbacks and requires an unspecified extra skill installation.

Install only if you trust Pincaimao with applicant resumes, interview responses, videos, and generated reports. Before use, confirm where pincaimao-basic comes from, avoid autonomous installation of unspecified dependencies, and only set url_callback to a trusted endpoint because reports may contain sensitive candidate data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unverified Mandatory Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 22
Vulnerability Type: Supply-chain exposure through an unspecified dependency
Risk Level: Medium

Vulnerable Code Snippet

The instruction at line 22 states:

text

REQUIRED: First check whether `pincaimao-basic` is installed. If it is not installed, install it first, and then load it to learn the common interfaces for file upload, authentication, response formats, and SSE parsing.

Technical Analysis

The Skill requires the agent to install and load pincaimao-basic, but it does not identify an authoritative package registry, repository URL, immutable version, commit, checksum, or signature.

Consequently, dependency resolution is left to the executing agent or its environment. An attacker could publish or substitute a package or Skill with the expected name through dependency confusion, namespace squatting, search-result manipulation, or compromise of an unpinned upstream release.

Loading such a dependency may execute or introduce instructions that were not included in this audited package. Requiring installation also exceeds the demonstrated minimum privileges of this Skill: the documented API operations can be performed with the already declared curl and python3 tools.

Attack Path

1. An attacker publishes or promotes a malicious component named pincaimao-basic.
2. The agent loads this Skill and follows the mandatory prerequisite instruction.
3. Because no trusted source or immutable version is specified, the agent resolves the attacker-controlled component.
4. The agent installs and loads that component.
5. Malicious code or instructions execute with the permissions available to the agent or installation process.

Impact Assessment

The precise impact depends on the installation mechanism and execution environment, neither of which is specified. If the dependency can execute code, it may obtain the agent's available Ba ...[truncated 419 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the mandatory dependency if the API workflow can remain self-contained.
2. If it is required, identify one authoritative HTTPS repository or trusted package registry.
3. Pin the dependency to an immutable version or commit and provide a cryptographic checksum or signature.
4. Document the exact installation command rather than allowing ambiguous package discovery.
5. Require explicit user approval before installing or loading external components.
6. Install the dependency in an isolated, least-privileged environment without unnecessary access to API keys, local files, or host-level package management.
7. Vendor and audit the minimal required parsing or authentication logic where practical.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:79

Finding

Unescaped Data Interpolation into JSON Request Bodies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 79–112
Vulnerability Type: JSON injection and malformed request construction
Risk Level: Medium

Vulnerable Code Snippet

First-round request construction:

bash

QUERY=$(echo "$JOB_INFO" | cut -c1-20)
ROUND1=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_ONLINE_INTERVIEW_KEY" \
  -H 'Content-Type: application/json' \
  -d "{
    \"query\": \"$QUERY\",
    \"inputs\": {
      \"job_info\": \"$JOB_INFO\",
      \"job_title\": \"$JOB_TITLE\",
      \"file_url\": \"$COS_KEY\",
      \"file_name\": \"$FILE_NAME\",
      \"question_number\": \"5\"
    },
    \"response_mode\": \"blocking\"
  }")

Subsequent-round request construction:

bash

USER_ANSWER="I have five years of sales experience and specialize in enterprise customer development..."
curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_ONLINE_INTERVIEW_KEY" \
  -H 'Content-Type: application/json' \
  -d "{
    \"query\": \"$USER_ANSWER\",
    \"inputs\": {},
    \"conversation_id\": \"$CONV_ID\",
    \"response_mode\": \"blocking\"
  }" | python3 -c "import sys,json; print(json.load(sys.stdin)['answer'])"

Technical Analysis

The examples directly interpolate shell variables into JSON string literals without applying JSON encoding. A value containing a double quote, backslash, newline, control character, or crafted JSON fragment can terminate or alter the intended string value.

Relevant values include user-controlled job descriptions and interview answers, local or API-derived filenames, job titles, storage keys, and conversation identifiers. For example, an answer containing a quote followed by additional JSON syntax can produce a malformed body or introduce extra object members, depending on its position and the remote parse ...[truncated 1601 chars]

Remediation

View remediation

Remediation Suggestions

Construct request bodies with a JSON-aware encoder instead of shell string interpolation. For example:

bash

PAYLOAD=$(python3 -c '
import json
import os

print(json.dumps({
    "query": os.environ["QUERY"],
    "inputs": {
        "job_info": os.environ["JOB_INFO"],
        "job_title": os.environ["JOB_TITLE"],
        "file_url": os.environ["COS_KEY"],
        "file_name": os.environ["FILE_NAME"],
        "question_number": "5"
    },
    "response_mode": "blocking"
}))
')

curl --fail-with-body --silent --show-error \
  -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_ONLINE_INTERVIEW_KEY" \
  -H 'Content-Type: application/json' \
  --data-binary "$PAYLOAD"

Additional hardening should include:

1. Use jq -n --arg or a language JSON library for every request.
2. Validate API-derived identifiers and storage keys before reuse.
3. Apply reasonable length limits to job descriptions, answers, titles, and filenames.
4. Use curl --fail-with-body --silent --show-error and verify the response content type and schema before extracting fields.
5. Avoid logging request bodies, authorization headers, resumes, or interview responses.
6. Add tests containing quotes, backslashes, Unicode, newlines, and JSON-like input to verify correct serialization.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: pincaimao-online-interview
description: 聘才猫 - 在线面试 Use when calling Pincaimao Online Interview API to conduct a multi-turn AI interview session. Supports text and video interview modes, custom question lists, and report callbacks. Requires PCM_ONLINE_INTERVIEW_KEY env var.
version: 1.0.1
allowed-tools:
  - Bash
metadata:
  openclaw:
    emoji: "🎥"
    homepage: https://www.pincaimao.com
    primaryEnv: PCM_ONLINE_INTERVIEW_KEY
    requires:
      env:
        - PCM_ONLINE_INTERVIEW_KEY
      bins:
        - curl
        - python3
---

# 聘才猫 - 在线面试

**REQUIRED:** 请先检查是否已安装

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

RESUME_FILE="/path/to/resume.docx"

# Step 1: 上传简历（可选）
UPLOAD=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/files/upload' \
  -H "Authorization: Bearer $PCM_ONLINE_INTERVIEW_KEY" \
  -F "file=@$RESUME_FILE")
COS_KEY=$(echo "$UPLOAD" | python3 -c "import sys,json; print(json.load(sys.stdin)['cos_key'])")

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

# Step 2: 第一轮 - 开始面试
QUERY=$(echo "$JOB_INFO" | cut -c1-20)
ROUND1=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_ONLINE_INTERVIEW_KEY" \
  -H 'Content-Type: application/json' \
  -d "{

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md

# Step 3: 后续轮次 - 提交回答
USER_ANSWER="我有5年销售经验，擅长大客户开拓..."
curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_ONLINE_INTERVIEW_KEY" \
  -H 'Content-Type: application/json' \
  -d "{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

RESUME_FILE="/path/to/resume.docx"

# Step 1: 上传简历（可选）
UPLOAD=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/files/upload' \
  -H "Authorization: Bearer $PCM_ONLINE_INTERVIEW_KEY" \
  -F "file=@$RESUME_FILE")
COS_KEY=$(echo "$UPLOAD" | python3 -c "import sys,json; print(json.load(sys.stdin)['cos_key'])")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

RESUME_FILE="/path/to/resume.docx"

# Step 1: 上传简历（可选）
UPLOAD=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/files/upload' \
  -H "Authorization: Bearer $PCM_ONLINE_INTERVIEW_KEY" \
  -F "file=@$RESUME_FILE")
COS_KEY=$(echo "$UPLOAD" | python3 -c "import sys,json; print(json.load(sys.stdin)['cos_key'])")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md

RESUME_FILE="/path/to/resume.docx"

# Step 1: 上传简历（可选）
UPLOAD=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/files/upload' \
  -H "Authorization: Bearer $PCM_ONLINE_INTERVIEW_KEY" \
  -F "file=@$RESUME_FILE")
COS_KEY=$(echo "$UPLOAD" | python3 -c "import sys,json; print(json.load(sys.stdin)['cos_key'])")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

# Step 2: 第一轮 - 开始面试
QUERY=$(echo "$JOB_INFO" | cut -c1-20)
ROUND1=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_ONLINE_INTERVIEW_KEY" \
  -H 'Content-Type: application/json' \
  -d "{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md

# Step 2: 第一轮 - 开始面试
QUERY=$(echo "$JOB_INFO" | cut -c1-20)
ROUND1=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_ONLINE_INTERVIEW_KEY" \
  -H 'Content-Type: application/json' \
  -d "{

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill documentation claims it does not transmit data to any endpoint other than api.pincaimao.com, but the same file documents a user-supplied url_callback that causes interview reports to be POSTed to arbitrary URLs. This is a misleading security boundary that can cause operators to approve or automate the skill without realizing sensitive applicant data may be exfiltrated to third-party endpoints.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.