Security audit

ai-career-position

Security checks for vulnerabilities and agentic risk

Overview

This career-assistant skill is mostly transparent and local, but its recommended installer runs mutable remote code and can overwrite skill folders across multiple AI tools.

Review the installer before using it. Prefer cloning or downloading a tagged release, inspecting install.sh, and installing only the AI environment you actually use. Avoid the curl | bash one-liner, keep the inbox server off when not actively saving a JD, and treat workspace/ as sensitive because it may contain resumes, salary expectations, offers, and interview notes.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: README.md:34
Finding: Mutable Remote Installer Is Piped Directly into a Shell
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: install.sh:21
Finding: Unverified Mutable Repository Snapshot Is Installed Across Multiple Agent Environments
Content: View full analysis
/dev/null 2>&1; then rsync -a --delete \ --exclude '.git' \ --exclude 'workspace' \ --exclude '.DS_Store' \ "$SOURCE_DIR/" "$dest/$SKILL_NAME/" else rm -rf "$dest/$SKILL_NAME" cp -R "$SOURCE_DIR" "$dest/$SKILL_NAME" rm -rf "$dest/$SKILL_NAME/.git" "$dest/$SKILL_NAME/workspace" fi installed="$installed $t" done ``` ### Technical Analysis When the installer is ...[truncated 1946 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/inbox_server.py:47
Finding: Unauthenticated Wildcard-CORS Local Inbox Permits Cross-Origin Data Injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/tracker.py:63
Finding: Tracker Writes Untrusted Spreadsheet Cells Without Formula or Record Sanitization
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (71)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 32)May include surrounding context.
text
# —— 日志与临时 —— *.log *.tmp .env

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The use of shell chaining into bash is a classic command-execution anti-pattern because it converts downloaded text into executable code with no review step. If the remote content is malicious or tampered with, the user immediately grants it execution on their machine, enabling credential theft, persistence, or modification of agent configuration. Within a skill ecosystem, such compromise may also tamper with other installed skills or host-level AI tooling.
Content: Scanner excerpt · README.md (reported line 36)May include surrounding context.
不用先下载，打开终端贴这一句回车：

bash
curl -fsSL https://raw.githubusercontent.com/tanchunzhuo/ai-career-position/main/install.sh | bash

脚本自动装到 WorkBuddy / Claude Code / Codex / Cursor 的 skills 目录。重启后直接说「帮我找方向」或「评估这个 JD」就会触发，不用记任何命令。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是技能的业务功能，但所给代码块实际只是安装器。它的主要行为是解析安装目标、定位源目录、必要时通过 curl 从 GitHub 下载仓库、解压后复制到用户主目录下各平台的 skills 目录，并可能覆盖已有内容。这与声明中的核心能力（本地评估 JD、识别骗局、生成简历、准备面试、比较 offer 等）不一致。虽然安装脚本可被视为配套实现细节，但当前提供的“代码块实际做什么”与声明用途存在明显偏差：代码并未实现所宣称的技能功能，反而执行了未在声明中体现的安装、网络访问和文件写入/删除操作。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个较完整的求职辅助/职业分析技能，核心能力围绕岗位分析、匹配评估、简历优化和求职决策。实际代码块则是单一的简历排版导出脚本：读取本地 HTML 文件，启动 Chromium，加载 file:// 页面并打印为 PDF。虽然这可被视为简历生成流程中的辅助步骤，但从该代码本身看，主功能与声明的主要用途明显不一致，而且声明中没有明确说明存在一个独立的 HTML→PDF 渲染工具。因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个较广泛的职业求职辅助技能，核心围绕JD/offer/简历/方向判断等功能。实际代码仅覆盖其中很小的一部分“准备面试”相关能力，而且还是以本地文件形式管理 STAR+R 故事库：创建故事模板、读取故事、列出故事、根据问题关键词做简单匹配。它不处理招聘JD、URL、截图，也不分析职位匹配、职级总包、外包培训贷、简历优化或offer比较。虽然“准备面试”与故事库存在弱相关，但该代码块的主要目的与声明的整体用途明显不一致，并引入了未在描述中明确说明的本地故事库存取与CLI交互模式，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · docs/PUBLISH_TO_GITHUB.md (reported line 41)May include surrounding context.
一路按提示操作即可；建议为私钥设置口令。随后打印公钥：

bash
cat ~/.ssh/id_ed25519.pub

复制整行内容，前往 GitHub：头像 → Settings → SSH and GPG keys → New SSH key，粘贴并保存。

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · docs/PUBLISH_TO_GITHUB.md (reported line 54)May include surrounding context.
一路按提示操作即可；建议为私钥设置口令。随后打印公钥：

bash
cat ~/.ssh/id_ed25519.pub

复制整行内容，前往 GitHub：头像 → Settings → SSH and GPG keys → New SSH key，粘贴并保存。

Chaining Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Piping remote content directly into bash is a classic dangerous command chain because it combines download and execution into one step with no review boundary. This materially increases the chance of compromise from repository takeover, CDN manipulation, or social engineering.
Content: Scanner excerpt · install.sh (reported line 11)May include surrounding context.
sh
# ./install.sh claude codex # 装指定平台 # # 远程一句话安装（无需先 clone，直接贴进终端回车）： # curl -fsSL https://raw.githubusercontent.com/tanchunzhuo/ai-career-position/main/install.sh | bash # # 支持的平台及其用户级 skills 目录（以各平台官方文档为准，2026-08）： # WorkBuddy -> ~/.workbuddy/skills

Chaining Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The help text again presents a direct network-to-shell chain, which is unsafe regardless of the script's benign stated purpose. Because this is an installer for a simple local skill, the convenience does not justify the elevated execution risk.
Content: Scanner excerpt · install.sh (reported line 35)May include surrounding context.
sh
./install.sh <平台...> 只装指定平台，例如：./install.sh workbuddy claude 远程一句话安装： curl -fsSL https://raw.githubusercontent.com/tanchunzhuo/ai-career-position/main/install.sh | bash EOF }

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · install.sh (reported line 66)May include surrounding context.
sh
# ---- 定位 skill 源目录 ---- # 若在项目目录内运行（旁边有 SKILL.md），直接用当前目录； # 否则（如 curl | bash 管道执行）下载 tarball 解压到临时目录。 SOURCE_DIR="" if [ -n "${BASH_SOURCE[0]:-}" ]; then SOURCE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: rm -rf "$dest/$SKILL_NAME" is a destructive filesystem operation in a user-controlled path context, and while quoting plus constrained target names reduce worst-case risk, it can still erase an existing installation without confirmation. In an installer for a benign skill, silent deletion of user data is an unnecessary integrity hazard.
Content: Scanner excerpt · install.sh (reported line 100)May include surrounding context.
sh
--exclude '.DS_Store' \ "$SOURCE_DIR/" "$dest/$SKILL_NAME/" else rm -rf "$dest/$SKILL_NAME" cp -R "$SOURCE_DIR" "$dest/$SKILL_NAME" rm -rf "$dest/$SKILL_NAME/.git" "$dest/$SKILL_NAME/workspace" fi

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The cleanup rm -rf "$dest/$SKILL_NAME/.git" "$dest/$SKILL_NAME/workspace" removes subdirectories after copying, which is destructive but scoped to the installed skill tree. It is less severe than arbitrary deletion, yet still poses a risk of deleting user modifications or workspace content without notice.
Content: Scanner excerpt · install.sh (reported line 102)May include surrounding context.
sh
else rm -rf "$dest/$SKILL_NAME" cp -R "$SOURCE_DIR" "$dest/$SKILL_NAME" rm -rf "$dest/$SKILL_NAME/.git" "$dest/$SKILL_NAME/workspace" fi installed="$installed $t" done

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · install.sh (reported line 108)May include surrounding context.
sh
done # ---- 清理临时目录 ---- [ -n "$TMP_DIR" ] && rm -rf "$TMP_DIR" # ---- 结果 ---- echo ""

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file contains exclusively Chinese natural-language guidance about the skill’s behavior, including user-facing output phrasing changes, with no indication that users can choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README asks users to execute a remote installer directly via curl piped to bash. That creates a trust-on-first-use remote code execution path: anyone who can alter the script source, repository, delivery path, or referenced branch can run arbitrary commands on the user's machine. For a job-evaluation skill, this installation method is not necessary to fulfill the core purpose and materially increases supply-chain risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README says that after installation users can simply say broad phrases like '帮我找方向' or '评估这个 JD' and the skill will trigger automatically. Broad natural-language triggers can cause accidental activation in unrelated conversations, leading the skill to ingest sensitive CV, salary, or job data when the user did not explicitly intend to invoke it. In a career-assistant context handling personal employment data, unintended invocation raises privacy and integrity concerns.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The activation guidance is ambiguous because it instructs users to paste prompt files into 'any AI' and then provide modules and JD text, but does not clearly separate setup steps from invocation boundaries. That ambiguity can cause the skill logic or prompt content to be applied in unintended contexts, including over-broad data exposure or accidental processing of sensitive job materials. Since the skill is designed to process resumes, salary expectations, and offer details, ambiguous triggering increases privacy risk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill defines broad natural-language triggers like job analysis, resume review, and career direction phrases that can occur in ordinary conversation. In agent environments, overly broad triggers can cause unintended invocation, pulling sensitive resume, profile, or local workspace data into the skill flow when the user did not clearly intend to activate it.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger section contains ambiguous phrases such as '帮我找方向', '我适合什么', and '看看这个简历' without hard scope boundaries. Because the skill is designed to read local files and potentially write tracking records, accidental activation in a general chat could expand data access and produce actions the user did not explicitly request.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file’s headings, descriptions, and user-facing guidance are entirely in Chinese, and there is no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This YAML file's comments, labels, reminders, and templates are all in Chinese, which can impose a fixed language/locale on users. The file does not indicate that Chinese is optional, user-selected, or required for a region-specific use case, so it appears to violate the language-choice policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This manifest-style YAML is entirely presented in Chinese, including comments, labels, and explanatory text, which effectively forces a specific language for users consuming the skill data. Under the policy, locale or language constraints should either be optional for the user or clearly documented as a justified region-specific limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file header comments and explanatory text are written entirely in Chinese, and the dataset entries also assume Chinese-language consumption throughout. For a general-purpose skill asset, this constitutes a natural-language locale constraint without any visible user opt-in or justification that the skill is intended only for Chinese-speaking users or a China-specific audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This YAML file contains user-facing natural-language policy content exclusively in Chinese, including explanations, actions, and disclaimers, but nowhere indicates that the skill is China-specific or that users can opt into this locale. Under the language/locale policy, forcing a specific language without user choice or clear justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.