T08 · Insecure Dependencies
Warning
- Location
SKILL.md:323- Finding
Unpinned Third-Party Python Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
求职自动申请
Security checks for vulnerabilities and agentic risk
Overview
This job-application skill is not malicious, but it asks for sensitive personal data and can submit real applications with unclear limits and optional confirmation.
Review carefully before installing. Use dry-run first, require explicit confirmation for every application, avoid broad automation prompts, keep API tokens in environment variables, and understand that your resume, contact details, authorization status, and application materials may be sent to third-party job platforms.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation says the free version does not support batch auto-submission, yet other sections describe automated multi-application submission with configurable maximum counts and submission steps. This contradiction can lead agents or users to trigger repeated real submissions under the false assumption that such behavior is unsupported or safely limited, creating risk of mass unintended disclosures of personal data and platform-policy violations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill automates application submission and result recording while handling highly sensitive personal data such as full name, email, phone number, resume path, work authorization, and platform credentials, but it does not clearly foreground data-handling, storage, transmission, retention, and third-party sharing risks. In this context, under-warning is dangerous because the workflow explicitly moves PII across external job platforms and may save artifacts locally.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger condition 'use when efficiency, automation, batch processing, workflow optimization are needed' is overly broad for a skill that has exec/read/write capabilities. Broad invocation criteria increase the likelihood that an agent will select this skill for unrelated tasks, unnecessarily granting a job-application workflow access to sensitive files or shell execution contexts.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill is presented as a narrowly scoped job-application assistant, but its documented 'core functions' expand into generic file handling and command execution. That scope mismatch can cause an agent or user to overtrust the skill and permit broader read/write/exec actions than are necessary for job-search automation, increasing the chance of misuse or unsafe command/file operations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description says '支持中文交互' as part of the skill behavior, but it does not indicate that users may choose another language or opt in to Chinese-only interaction. This can violate language or locale policy when the skill is presented to a broader audience without an explicit language choice.
- Content