ClawHub
Back to skill

Security audit

聘才猫（Pincaimao）简历诊断

Security checks for vulnerabilities and agentic risk

Overview

This resume-diagnosis skill mostly matches its stated purpose, but it requires installing and loading an unpinned helper skill before handling resumes, job descriptions, and an API key.

Install only if you trust Pincaimao with candidate resumes, job descriptions, and the API key. Before use, verify that `pincaimao-basic` comes from the expected publisher and version, and avoid sending confidential or regulated hiring data unless your organization has approved that external processing and storage.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:22
Finding

Unpinned External Skill Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 22
Vulnerability Type: Unverified and unpinned external dependency
Risk Level: Medium

Vulnerable Code Snippet

text
REQUIRED: First check whether `pincaimao-basic` is installed. If it is not installed, install it first, and then load it to learn the common interfaces for file upload, authentication, response formats, and SSE parsing templates.

Technical Analysis

The Skill requires the Agent to install and load an external Skill named pincaimao-basic, but it does not specify an exact version, authenticated source, publisher identity, or integrity hash. It also does not provide a safe installation procedure.

Loading another Skill is security-sensitive because its instructions can influence subsequent Agent behavior. In this case, the dependency is expected to control authentication and resume-upload operations. A malicious, replaced, or unexpectedly updated dependency could therefore instruct the Agent to disclose credentials or candidate data, contact undeclared endpoints, or execute commands through the permitted Bash tool.

The dependency does not automatically execute merely because this document is loaded; exploitation depends on how the runtime resolves, installs, and loads pincaimao-basic. Nevertheless, requiring an unidentified mutable dependency creates a supply-chain trust boundary that is not adequately constrained.

The static pre-scan warning concerning curl | bash was not confirmed. The audited file contains curl API requests, but none of their responses are piped into a shell for execution.

Attack Path

  1. An attacker publishes, replaces, or compromises a Skill resolvable under the name pincaimao-basic.
  2. The Agent follows the mandatory instruction on line 22 because the dependency is not already installed.
  3. The runtime resolves and installs the attacker-controlled or modified dependency without a pinned version or integrity verification.
  4. The ...[truncated 1083 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin pincaimao-basic to an exact, reviewed version rather than resolving it only by name.
  2. Specify an authenticated official registry or immutable source URL and the expected publisher identity.
  3. Verify a cryptographic digest or signed provenance record before installation or loading.
  4. Require explicit user confirmation before installing a missing external Skill.
  5. Vendor the minimal upload, authentication, and response-parsing instructions into this package where licensing and maintenance requirements allow.
  6. Audit the dependency and its transitive dependencies for network destinations, command execution, credential access, and instruction-hijacking behavior.
  7. Restrict the dependency to the minimum tools and environment variables needed for HTTPS requests to the documented API.
  8. Enforce an outbound network allowlist for api.pincaimao.com and prevent the dependency from sending the API key or resume data to other destinations.
  9. Prefer structured HTTP and JSON tools over unrestricted Bash where the runtime supports them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: pincaimao-resume-diagnosis
description: 聘才猫 - 简历诊断 Use when calling Pincaimao Resume Diagnosis Assistant API to parse and diagnosis a candidate resume against a job description. Requires uploading the resume file first to get cos_key. Requires PCM_RESUME_DIAGNOSIS_KEY env var.
version: 1.0.1
allowed-tools:
  - Bash
metadata:
  openclaw:
    emoji: "🎯"
    homepage: https://www.pincaimao.com
    primaryEnv: PCM_RESUME_DIAGNOSIS_KEY
    requires:
      env:
        - PCM_RESUME_DIAGNOSIS_KEY
      bins:
        - curl
        - python3
---

# 聘才猫 - 简历匹配

**REQUIRED:** 请先检查是否已�

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
JOB_TITLE="高级Java工程师"

# Step 1: 上传简历（任意 key 即可）
UPLOAD=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/files/upload' \
  -H "Authorization: Bearer $PCM_RESUME_DIAGNOSIS_KEY" \
  -F "file=@$RESUME_FILE")
COS_KEY=$(echo "$UPLOAD" | python3 -c "import sys,json; print(json.load(sys.stdin)['cos_key'])")

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
# Step 2: 简历匹配（使用智能体专属 key）
QUERY=$(echo "$JOB_INFO" | cut -c1-20)
curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_RESUME_DIAGNOSIS_KEY" \
  -H 'Content-Type: application/json' \
  -d "{

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The upload step transmits the full resume file to api.pincaimao.com, which is a third-party endpoint outside the local trust boundary. Because resumes commonly contain PII, contact details, work history, and other sensitive information, this is a genuine privacy and data-handling risk even though it is core functionality.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
JOB_TITLE="高级Java工程师"

# Step 1: 上传简历（任意 key 即可）
UPLOAD=$(curl -s -X POST 'https://api.pincaimao.com/agents/v1/files/upload' \
  -H "Authorization: Bearer $PCM_RESUME_DIAGNOSIS_KEY" \
  -F "file=@$RESUME_FILE")
COS_KEY=$(echo "$UPLOAD" | python3 -c "import sys,json; print(json.load(sys.stdin)['cos_key'])")

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The chat API call sends job description text and a file reference to an external service for AI analysis. In context this is expected behavior, but it still exposes potentially confidential recruiting information and candidate data to an external processor, so the finding is valid.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
# Step 2: 简历匹配（使用智能体专属 key）
QUERY=$(echo "$JOB_INFO" | cut -c1-20)
curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_RESUME_DIAGNOSIS_KEY" \
  -H 'Content-Type: application/json' \
  -d "{

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The chat API call sends job description text and a file reference to an external service for AI analysis. In context this is expected behavior, but it still exposes potentially confidential recruiting information and candidate data to an external processor, so the finding is valid.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
# Step 2: 简历匹配（使用智能体专属 key）
QUERY=$(echo "$JOB_INFO" | cut -c1-20)
curl -s -X POST 'https://api.pincaimao.com/agents/v1/chat/chat-messages' \
  -H "Authorization: Bearer $PCM_RESUME_DIAGNOSIS_KEY" \
  -H 'Content-Type: application/json' \
  -d "{

Static analysis

No suspicious patterns detected.