Security audit

maker-hunter

Security checks for vulnerabilities and agentic risk

Overview

This recruiting skill is purpose-aligned overall, but it asks users to share website cookies and run an unaudited global script, so it should be reviewed before installation.

Review this skill before installing. Do not paste raw cookies into an agent chat unless you understand they can act like account passwords. Prefer browser-based login, OAuth, or throwaway accounts, and verify any external script before running it. Avoid storing platform credentials in plaintext credentials.json.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:363
Finding: Unsafe Collection and Storage of Authentication Cookies
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:429
Finding: Execution of an Unbundled and Unverifiable Global Script
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (10)

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The explicit inclusion of a credentials.json file for platform credentials indicates planned credential access and retention by the skill. In a sourcing/messaging tool, collecting reusable account secrets is unnecessary and significantly raises the blast radius of compromise.
Content: Scanner excerpt · SKILL.md (reported line 320)May include surrounding context.
text
~/.config/openclaw/maker-hunter/ ├── credentials.json # 平台凭证 └── memory/ �} ├── founders.json # 历史候选人库 └── daily.json # 今日任务记录

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions normalize disclosure of highly sensitive cookies without any warning that cookies function as credentials and can expose the user's account. This omission materially increases the likelihood of accidental credential compromise because users may not understand the risk of sharing session tokens.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documented workflow creates a plain-language credential disclosure path by instructing the user to manually extract browser cookies and give them to the agent. Because cookies can be replayed, this is effectively a request for transferable authentication secrets and can lead to immediate session hijacking.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly tells the user to open developer tools, copy site cookies, and provide them to the agent. Raw session cookies are equivalent to active authentication sessions; disclosing them can let anyone replay the session and fully impersonate the user's account.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instructions mandate Chinese for 即刻 users and English for foreign-platform users, rather than offering a language choice. This is a natural-language locale policy issue because it forces language behavior based on platform/region instead of letting the user opt in or override it.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill requires outputting full candidate records, profile summaries, history reviews, links, and personalized outreach messages directly into chat, which can expose scraped personal data more broadly than needed. Centralizing and redisplaying aggregated profile intelligence increases privacy and confidentiality risk, especially if chats are logged, shared, or retained.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill scope is candidate discovery and outreach drafting, but it also specifies local storage of platform credentials in credentials.json, expanding access far beyond what is necessary. Persisting authentication material creates a reusable secret store that could enable account takeover or unauthorized scraping if the host, logs, or skill environment are compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill defines a local credentials.json for platform credentials but provides no guidance on encryption, access controls, minimization, or retention. Storing secrets in predictable plaintext locations increases the risk of theft by other local processes, backups, or users on the same machine.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 438)May include surrounding context.
首次使用需要创建 memory 目录：

bash
mkdir -p ~/.config/openclaw/maker-hunter/memory

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This file contains prescribed DM templates and platform phrasing in specific languages and dialects, such as Chinese wording and English openings like "Hi {username}". Because the guidance does not state that the skill is region-specific or allow the user to choose language/locale, it can conflict with a policy requiring user opt-in for language constraints.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.