ai-career-position

• Outcome: Review
• Latest audit: Aug 26, 2026 · 3:31 AM UTC
• Version: 0.1.0

Overview

This looks like a legitimate local career-assistant skill, but its one-line installer can execute mutable remote code and overwrite existing skill directories without a backup or confirmation.

Review install.sh before running it. Prefer cloning or downloading a fixed release, inspecting the files, and manually copying the skill instead of using curl | bash. If you use the optional bookmarklet, run it only on job-description pages and remember it stores captured page text locally under workspace/. Keep workspace/ private because it can contain resumes, salary expectations, interview stories, and application history.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares strong safety expectations in prose, but it also references capabilities consistent with file read/write, network access, and shell-adjacent scripting without any explicit permission declaration or enforcement boundary. That mismatch can lead hosts or reviewers to underestimate what the skill may do, especially because it mentions local file access, inbox services, bookmarklets, and scripts that could touch user data or fetch content.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The bookmarklet extracts the job page title, company, salary, full page text, current URL, hostname, and timestamp, then sends them via fetch() to a local HTTP endpoint. Even if the endpoint is local, this is still data exfiltration from arbitrary pages and exceeds a narrow 'local evaluation' expectation unless the capture is clearly disclosed and tightly scoped.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This bookmarklet is designed to run on arbitrary pages, scrape multiple DOM regions, and upload the results, which creates a cross-page collection mechanism. In the context of a career-assistant skill, that broad scraping capability is riskier because users may invoke it on pages containing personal or proprietary information beyond the intended JD content.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README instructs users to execute a remote script directly with `curl ... | bash`, which removes the opportunity to inspect the code before execution and creates a supply-chain risk if the repository, hosting account, or network path is compromised. In skill ecosystems, users often trust installation docs, so this materially increases the chance of arbitrary local code execution on the user's machine.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The description contains broad natural-language triggers such as '分析这个职位', '这个岗位怎么样', and '帮我找方向', which are common conversational phrases and may cause unintended invocation. Accidental activation can expose sensitive resume or job-search context to the skill unexpectedly, even if the skill itself is not overtly malicious.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The dedicated trigger section repeats ambiguous activation phrases, increasing the chance the skill will fire during ordinary career discussion rather than deliberate invocation. In this skill's context, unintended activation matters because the workflow reads local resume/profile files and may write application-tracking data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The installer overwrites existing skill contents in user directories via rsync --delete or rm -rf/cp without any explicit warning, backup, or confirmation prompt. This can destroy local modifications or previously installed content, and the risk is heightened because the script targets multiple tool-specific directories automatically.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The prompt hard-codes Chinese-language behavior and output format without giving users a language choice or documenting that the skill is intended only for Chinese-speaking users. This can cause misleading, inaccessible, or unusable results for non-Chinese users and may prevent informed consent about how the skill will interact with their input.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The prompt instructs the agent to store interview stories under `workspace/interviews/stories/*.md`, but it does not require notifying the user or obtaining confirmation before persisting potentially sensitive career history to disk. This creates a privacy and data-handling risk because users may not realize their personal interview content is being retained across sessions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: When --out is used, the tool writes an HTML report containing extracted resume text, including potentially sensitive personal data, to disk without a strong warning, consent checkpoint, or protective defaults. In a local-only skill this is less severe than network exfiltration, but it still increases the risk of unintended persistence, later disclosure via backups/shared folders, or exposure to other local users/processes.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code sends page content and the current URL to an endpoint immediately, with no prior user-facing warning or review step. This lack of transparent notice and confirmation can cause users to disclose sensitive page data unintentionally, especially because bookmarklets execute in the security context of the current page.

External Script Fetching

High

• Category: Supply Chain

Content

# ---- 定位 skill 源目录 ----
# 若在项目目录内运行（旁边有 SKILL.md），直接用当前目录；
# 否则（如 curl | bash 管道执行）下载 tarball 解压到临时目录。
SOURCE_DIR=""
if [ -n "${BASH_SOURCE[0]:-}" ]; then
  SOURCE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

• Confidence: 90% confidence
• Finding: The installer is explicitly designed to support execution from a remote curl | bash flow and then downloads archive content from a mutable branch reference (main) without pinning or integrity verification. If the upstream repository, branch, network path, or hosting account is compromised, users may execute attacker-controlled code and install attacker-controlled skill content.

Static analysis

No suspicious patterns detected.