Security audit

hunter-qg

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Jike talent-search workflow that uses a logged-in browser and local candidate list, with privacy considerations but no hidden or destructive behavior.

Install only if you are comfortable letting the agent browse Jike with your chosen logged-in browser profile and save candidate profile data locally. Use a dedicated or low-risk browser profile when possible, and periodically review or delete the talent-pool file if you no longer need the stored records.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly instructs persistent local storage of third-party personal data, including user identifiers, profile links, and behavioral assessments, without any notice, consent flow, retention policy, or minimization guidance. This creates a privacy and compliance risk because the operator may collect and retain identifiable information about people from a logged-in platform session without transparency or clear authorization boundaries.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The workflow directs the agent to take over a browser profile and use the user's authenticated 即刻 session, but it does not warn the user that the skill will access account-scoped content and operate with their login state. This is dangerous because authenticated browser access can expose private or semi-private data and allows actions to be performed under the user's identity if the browsing tool has broader capabilities than intended.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: The skill description and operating instructions are entirely in Chinese and present the workflow as Chinese-only, with no indication that the user may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Static analysis

No suspicious patterns detected.