面试模拟工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:35 AM UTC
• Version: 1.0.3

Overview

This interview-practice skill is mostly a Markdown prompt, but it asks for broad shell and file permissions that do not fit its stated purpose.

Install only if you are comfortable with a prompt-only interview tool that nevertheless requests shell and filesystem authority. Prefer a version with exec/write removed, consistent metadata, and explicit limits for any optional scorecard export or resume analysis.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Excessive Shell and Filesystem Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5 and 19–21; related command guidance at lines 230, 233, and 242
Vulnerability Type: Violation of least privilege through unnecessary exec, read, and write capabilities
Risk Level: Medium

Vulnerable Code Snippet

yaml

allowed-tools: read exec

yaml

tools:
  - exec
  - read
  - write

Related documentation also classifies the skill as command-enabled and directs the agent to run a network diagnostic:

markdown

- 本工具为纯 Markdown 指令，无需额外 API Key

markdown

- **分类**: MD+EXEC（Markdown 指令 + 命令行执行）

markdown

| 网络错误 | 连接超时或不可达 | 执行ping命令测试网络连通性,检查防火墙和代理设置连接后执行ping命令测试网络连通性,检查防火墙和代理设置连接后重新执行命令，参考国内替代方案 |

Technical Analysis

The skill's stated function is to conduct a conversational interview simulation, evaluate answers, and generate a scorecard. These operations do not require shell execution or local filesystem access. Nevertheless, the skill declares exec, read, and write capabilities.

The permission declarations are also inconsistent: the top-level allowed-tools field grants read and exec, while the separate tools list additionally declares write. Depending on how an agent platform resolves conflicting metadata, the skill could receive broader access than a reviewer or operator expects.

The documented ping operation does not justify general-purpose shell access. A broad exec capability is substantially more powerful than a constrained connectivity check. Because the skill accepts user-controlled interview responses and pasted resume content, unnecessarily exposing privileged tools increases the consequences of prompt injection embedded in that content.

No direct instruction to execute an attacker-controlled command was identified. This finding concerns excessive capability and the resulting attack surface rather than confirmed malicious command execution.

Attack Pa

...[truncated 1320 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec, read, and write from the skill metadata because the interview workflow can operate entirely through language-model interaction.
2. If a tool is genuinely required in a future version, grant only the specific capability needed and enforce strict path, command, argument, and network-destination allowlists.
3. Make all permission declarations consistent; do not maintain conflicting allowed-tools and tools lists.
4. Remove the ping recommendation. Report connectivity failures descriptively or rely on platform-controlled health checks rather than general-purpose command execution.
5. Treat resumes and interview responses as untrusted data. Explicitly instruct the agent not to follow commands or operational instructions embedded in user-provided documents.
6. Enforce runtime confirmation and sandboxing for any future filesystem or shell operation.
7. Add automated validation that rejects undeclared, contradictory, or unnecessary tool permissions during packaging.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation description is overly broad, covering generic efficiency, automation, and workflow optimization scenarios well beyond interview simulation. That increases the chance the skill is invoked for unrelated tasks, where its declared exec/write capabilities and ambiguous instructions may be misapplied.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is presented as a simple interview simulator, but the documentation adds generic CRUD, query, export, save, and delete-style capabilities that are unrelated to the stated purpose. This mismatch expands the apparent operational scope and can cause an agent or orchestrator to authorize unnecessary data-handling behaviors, increasing the risk of unintended file or state manipulation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Introducing save/export/delete semantics for a personal interview practice tool is unjustified by the skill's core function and may normalize destructive or data-moving operations. In environments where agents infer capabilities from documentation, this can lead to overbroad execution, including writing, exporting, or deleting content without a legitimate business need.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The keyword coverage section expands the skill's scope using vague, marketing-style phrases instead of precise trigger conditions and exclusions. In agent ecosystems that rely on semantic matching, this can cause accidental routing of unrelated requests into a skill that also advertises unnecessary operational capabilities.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file claims to be a pure Markdown skill requiring no extra API key, yet elsewhere describes EXEC usage, command execution precautions, HTTPS communication, and ping-based network diagnostics. These contradictions obscure the real trust boundary and may encourage an agent to execute shell or network actions that users would not expect from a local interview simulator.

Content

No source excerpt is available for this finding.