ClawHub
Back to skill

Security audit

面试模拟工具专业版

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed recruiting/interview analytics prompt skill, but users should handle resume data and command execution carefully.

Before installing, treat resumes, scorecards, and funnel reports as sensitive recruiting records. Use the skill only in an authorized workspace, review any files before saving or exporting them, avoid unnecessary retention of candidate data, and do not allow arbitrary shell commands beyond clearly understood diagnostics or local analysis steps.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill is presented as an interview simulation and recruiting analytics tool, yet it declares `exec` capability and explicitly recommends network diagnostics such as `ping`. That broadens the operational scope beyond the stated business purpose and creates an unnecessary command-execution surface that could be abused if user-controlled input is ever routed into shell commands or troubleshooting steps.

Intent-Code Divergence

Medium
Confidence
77% confidence
Finding
The documentation says no additional API key is needed, but later security guidance discusses protecting API keys via environment variables. This inconsistency can mislead operators about whether secrets are required, where they come from, and how they should be handled, increasing the chance of insecure ad hoc configuration or accidental secret exposure.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill explicitly supports importing resumes and exporting/saving outputs, but it does not provide a clear warning or control guidance for handling candidate personal data. In a recruiting context, resumes commonly contain PII and employment history, so omission of privacy safeguards increases the risk of over-collection, unintended retention, and disclosure through files, logs, or downstream exports.

Static analysis

No suspicious patterns detected.