Career Future Mirror

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:31 AM UTC
• Version: 1.0.0

Overview

This career-planning skill is not malicious, but it should be reviewed because it quietly saves sensitive career conversations and may expose user background through web searches and remote report scripts.

Review this skill before installing if you would share a resume, employer history, salary goals, or personal career concerns. Only use it with information you are comfortable saving locally, and avoid including identifying details in web searches unless the agent shows you the exact search terms first. Generated HTML reports may contact third-party CDNs when opened.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: SKILL.md:170
• Finding: Personal Career Information May Be Disclosed Through External Web Searches<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 170-173 **Vulnerability Type**: Privacy Data Disclosure **Risk Level**: Medium ### Vulnerable Code ```text 根据用户的目标方向，使用 WebSearch 工具搜索： - `{行业} 2025-2026趋势` - `{目标职位} 薪资范围 要求` - `{用户背景} 转型路径 成功案例` ``` English translation: ```text Use the WebSearch tool to search based on the user's target direction: - `{industry} 2025-2026 trends` - `{target position} salary range requirements` - `{user background} transition paths success stories` ``` ### Technical Analysis The workflow directs the agent to interpolate the user's background into an external search query. The information collected elsewhere in the Skill can include educational institutions, employers, positions, employment history, skills, income expectations, career concerns, and résumé content. No instruction requires the agent to minimize, anonymize, or redact this information before submitting the query. The workflow also does not require informed user consent before disclosing data to the search provider. Consequently, personally identifying or sensitive career information may be transmitted to an external service and retained in provider logs, telemetry, browser history, or query records. ### Attack Path 1. A user submits a résumé or detailed career background to the Skill. 2. The Skill extracts information such as the user's school, employer, position, experience, and career goals. 3. During market research, the agent constructs a query using the `{user background}` placeholder. 4. The WebSearch tool sends that query to an external search provider. 5. The provider receives and may log or retain the included personal information. 6. Anyone with access to provider logs, organizational search records, or compromised service infrastructure could obtain the disclosed data. ### Impact Assessment This issue does not grant local system privileges or code-execution capabilities. Its impact is limited primarily to confidentiality an ...[truncated 381 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prohibit the inclusion of names, contact details, schools, employers, exact job histories, résumé text, and other identifying information in external search queries. 2. Restrict searches to generic terms such as industry, target role, region, seniority, and broadly defined experience level. 3. Add an explicit data-minimization step that converts user details into non-identifying categories before invoking WebSearch. 4. Obtain explicit user consent before sending any user-derived information to an external provider. 5. Present the proposed search terms to the user for approval when they may contain sensitive information. 6. Document what information is transmitted, which provider receives it, and whether it may be retained. 7. Prefer privacy-preserving or locally indexed research sources where available. A safer query pattern would be: ```text - `{industry} 2025-2026 trends` - `{generic target role} salary range and requirements` - `{experience level} to {generic target role} transition examples` ``` ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:681
• Finding: Generated Reports Execute Mutable Third-Party CDN Dependencies Without Integrity Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 681-690 and 757-759 **Vulnerability Type**: Insecure Third-Party Dependencies **Risk Level**: Medium ### Vulnerable Code Career report template: ```html <!-- TailwindCSS --> <script src="https://cdn.tailwindcss.com"></script> <!-- Google Fonts --> <link href="https://fonts.googleapis.com/css2?family=Playfair+Display:wght@700&family=Cormorant+Garamond:wght@400;700&display=swap" rel="stylesheet"> <!-- Chart.js --> <script src="https://cdn.jsdelivr.net/npm/chart.js"></script> <!-- Alpine.js --> <script defer src="https://cdn.jsdelivr.net/npm/alpinejs@3.x.x/dist/cdn.min.js"></script> ``` Future-letter template: ```html <script src="https://cdn.tailwindcss.com"></script> <link href="https://fonts.googleapis.com/css2?family=Playfair+Display:ital,wght@0,700;1,700&family=Cormorant+Garamond:wght@400;600&display=swap" rel="stylesheet"> <script defer src="https://cdn.jsdelivr.net/npm/alpinejs@3.x.x/dist/cdn.min.js"></script> ``` ### Technical Analysis The generated HTML reports load executable JavaScript directly from third-party content delivery networks. Tailwind and Chart.js are referenced without exact version pins, while Alpine.js uses the floating `3.x.x` version range. None of the resources use Subresource Integrity, and the templates do not define a restrictive Content Security Policy. As a result, the code executed when a report is opened is not fully represented by the audited project. It can change after the audit due to upstream releases, CDN compromise, package compromise, account takeover, or malicious modification at the distribution source. Because the report contains career and potentially identifying user information, injected JavaScript could read the rendered document, modify recommendations, monitor user interaction, or send report content to an external endpoint. Browser sandboxing limits the code to the report's browser context, but it does not prevent access to the ...[truncated 1436 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bundle audited JavaScript and CSS dependencies locally with the generated reports. 2. Pin every dependency to an exact reviewed version rather than using unversioned URLs or floating ranges such as `3.x.x`. 3. When remote resources are unavoidable, add Subresource Integrity hashes and the appropriate `crossorigin` attribute. 4. Define a restrictive Content Security Policy that allows scripts only from explicitly approved sources and limits outbound connections with `connect-src`. 5. Avoid Tailwind's runtime CDN build in generated production documents; generate static CSS during a controlled build process. 6. Prefer static report rendering where interactive JavaScript is not necessary. 7. Establish a dependency-review and update process that verifies hashes and security advisories before changing pinned versions. 8. Consider making generated reports self-contained so they remain functional offline and do not contact third parties when opened. Example hardened resource reference: ```html <script src="./vendor/alpinejs-3.14.9.min.js" integrity="sha384-REPLACE_WITH_VERIFIED_HASH" crossorigin="anonymous" defer> </script> ``` The integrity value must be generated from and verified against the exact audited artifact. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Natural-Language Policy Violations

High

• Confidence: 99% confidence
• Finding: 技能强制所有输出必须使用中文，即使用户明确使用英文也不允许切换语言，剥夺了用户对交互语言的选择权。对多语言用户或需精确理解隐私告知、职业建议内容的场景，这会增加误解、错误决策和无效同意的风险。

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: 该技能要求收集简历、教育经历、工作经历、收入预期等高度敏感的职业和个人信息，并生成本地文件，但未在收集前向用户说明隐私影响、存储位置、保留范围或是否可拒绝。对职业规划场景而言，这些数据具备较强身份识别性，未经告知的收集与写入会显著增加隐私泄露风险。

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: 文档明确要求“静默地”将对话追加保存到 JSON，这意味着对持久化存储行为刻意不向用户披露。该记录包含用户原话和系统生成的未来镜像回复，可能浓缩职业困惑、收入目标、经历细节等敏感内容，一旦被其他流程或人员访问将造成隐私暴露。

Hidden Instructions

High

• Category: Prompt Injection

Content

**首屏结构示例**：
```html
<section class="min-h-screen flex items-center justify-center bg-gradient-to-br from-stone-100 to-amber-50 relative overflow-hidden">
  <!-- 装饰性背景元素 -->
  <div class="absolute inset-0 opacity-5">
    <div class="absolute top-20 left-20 w-96 h-96 rounded-full bg-amber-200 blur-3xl"></div>
    <div class="absolute bottom-20 right-20 w-80 h-80 rounded-full bg-stone-300 blur-3xl"></div>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: 技能元数据中的触发关键词覆盖“职业困惑”等日常高频表达，且没有明确排除条件，容易在普通聊天或泛化求助场景被误激活。误触发后会进入信息收集、联网搜索和本地写入流程，导致用户在未充分预期下暴露个人职业与履历信息。

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: “用户表达职业规划/转型/困惑的意向”属于语义边界极宽的激活条件，缺少激活与不激活判定标准。由于该技能后续会索取详细背景、简历和偏好数据，这种模糊触发会放大非预期数据收集与流程启动风险。

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: 技能设计要求记录并复用完整对话历史来生成未来来信，形成可持续存在的自然语言档案。由于内容可能包含年龄焦虑、职业转型顾虑、收入目标、工作经历等敏感信息，长期留存与二次使用会扩大泄露面，也增加被误读、误用或越权访问的风险。

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: This JSON schema defines all titles, labels, placeholders, and option values in English, but does not offer any language selection or indicate that English is an intentional, justified locale constraint. Under the policy rule for natural-language violations, forcing a single language without user opt-in can be a locale-policy issue.

Static analysis

No suspicious patterns detected.