Security audit

boss直聘自动化（无GUI）

Security checks for vulnerabilities and agentic risk

Overview

This skill controls the live desktop to send job-platform messages and includes weak safeguards plus guidance to exaggerate qualifications.

Review carefully before installing. In its current form, run it only in an isolated environment and only after changing it to draft messages, remove qualification-exaggeration guidance, require explicit approval before every send, verify the active Boss Zhipin page and recipient, add limits, and define screenshot retention.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: main.py:244
Finding: Unverified fixed-coordinate automation can capture or interact with unintended applications
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:4
Finding: Unpinned and unnecessary dependencies create avoidable supply-chain exposure
Content: View full analysis
=0.9.5 pyperclip>=1.8.2 Pillow>=10.0.0 # Optional dependencies pytesseract # If using pytesseract OCR easyocr # If using easyocr OCR paddleocr # If using paddleocr OCR ``` `.gitignore:30`: ```text package-lock.json ``` `SKILL.md:25-34`: ```bash pip install pyautogui>=0.9.5 pyperclip>=1.8.2 Pillow>=10.0.0 ``` ```bash cd skills/ocr-local npm install ``` ### Technical Analysis The Python dependencies use lower-bound constraints or no constraints. Consequently, each installation may resolve to different package versions that were not reviewed with this project. The requirements also list three optional OCR packages that are not imported or used by the included Python implementation. These packages can introduce large transitive dependency trees without providing functionality to the audited workflow. The documentation instructs users to execute `npm install` in an external `skills/ocr-local` component that is not present in this project. At the same time, `package-lock.json` is ignored, preventing reproducible npm resolution if that component is later placed in or developed alongside the project. There is no evidence that any currently named dependency is intentionally malicious. The issue is that mutable, unnecessary, and externally supplied dependency resolution increases exposure to future compromised releases, dependency substitution, or unreviewed transitive code. ### Attack Path 1. A user follows the installation instructions and runs `pip install -r requirements.txt`. 2. The package manager resolves the newest versions satisfying the broad constraints, including unused OCR packages and their transitive dependencies. 3. If a future r ...[truncated 1186 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 8)May include surrounding context.
text
*.so # User-specific .env .pytest_cache/ .hypothesis/ .vscode/

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document states that generated outreach should 'appropriately exaggerate' technical qualifications and imitate human language habits, which directly promotes deceptive self-presentation. In a job application automation context, this is dangerous because it facilitates fraud, misrepresentation, and trust manipulation at scale.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The messaging guidance explicitly tells users to exaggerate qualifications and imitate natural human language, which is direct support for deceptive impersonation in outbound communication. This is especially dangerous in a recruiting context because it facilitates fraud, misrepresentation, and trust manipulation toward real human recipients.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Automated message sending to employers occurs with no confirmation, preview, rate limit, or safety interlock. In this skill’s context, that directly enables unsolicited bulk outreach and accidental messaging, which can violate platform rules, damage accounts, and contact real third parties without operator intent at the moment of send.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file describes screenshot capture and OCR processing of on-screen job content without warning that visible data may include sensitive or personal information. Because screen capture tools can inadvertently collect unrelated on-screen content, the omission increases privacy and data-handling risk for users and third parties.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The combined workflow links qualification exaggeration, human-like phrasing, strong expression of interest, and automated send actions into a scalable deceptive outreach pipeline. This increases risk beyond isolated wording issues because it operationalizes trust-building deception and mass unsolicited messaging in a recruiting context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document explicitly describes automated clicking, pasting, and sending of messages on the user's behalf, but provides no warning, confirmation requirement, or consent boundary. In the context of a job-platform automation skill, this creates a real risk of unauthorized outreach, spam, and unintended account actions if the automation runs without clear user review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README describes automation that clicks, scrolls, captures screenshots, and sends messages, but it does not clearly warn that these actions will control the user's GUI and can affect whatever application is in focus. That omission increases the chance of accidental interaction with the wrong window, unintended data capture, or misdirected actions on the local system.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The generation rules instruct the skill to imitate natural human language habits using fluent Chinese expression. This is a locale/language constraint presented as mandatory behavior, and the README does not indicate that users can choose another language or opt into Chinese-only operation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill automates clicking, browsing, and message sending on a third-party job platform, but the description does not warn users that it can take real actions through their account. That omission increases the risk of unintended outreach, account misuse, and violation of platform rules because operators may not realize the automation has externally visible effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill captures screenshots of job pages and runs OCR over their contents without any privacy notice, data-handling guidance, or retention limits. This can expose job-posting data, recruiter information, and potentially sensitive page content to local storage or downstream processing without informed user consent.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented workflow systematically screens targets, generates tailored persuasive content, and automatically initiates contact on a third-party platform. In context, this is more dangerous because it operationalizes scaled outbound manipulation and spam-like behavior, reducing human review before messages are sent and enabling misuse for deceptive mass outreach.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring describes scrolling, clicking, screenshots, and navigation, but omits the script’s ability to paste and send messages automatically. This understates the automation’s real capability, which can mislead downstream users or orchestrators into invoking a tool that can perform outbound communications without clear disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The paste_and_send function performs clipboard paste and immediately sends the message with Enter, without any confirmation, preview, recipient verification, or rate limiting. In a GUI automation context, focus mistakes or malicious orchestration could cause unintended messages to be sent to the wrong party, potentially leaking sensitive clipboard contents or enabling spam/phishing at scale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file content is a fixed Chinese message and provides no indication that another language can be selected. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · cli.py (reported line 107)May include surrounding context.
python
log_step(f"执行 OCR: {image_path}") try: result = subprocess.run( ['node', str(ocr_script), '--image', image_path], capture_output=True, text=True,

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The description says the skill automates job browsing, OCR analysis, and communication, but it does not define clear activation boundaries, consent requirements, or limits on when automated messaging should occur. In a skill that can read on-screen job content and initiate chats, vague scope increases the chance of unintended outreach, over-broad data collection, or misuse beyond the user's explicit intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest uses a Chinese-only job platform description and fixes OCR processing to simplified Chinese plus English, with no indication that users can choose another language or locale. This creates a natural-language locale constraint that is not presented as optional or explicitly justified as a region-specific tool.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file's natural-language interface and operational messaging are entirely in Chinese, including the skill description and runtime logs, with no indication that users can select another language. This can violate language/locale policy when a skill imposes a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The function description suggests a simple single-job processing flow, but the implementation automatically initiates employer contact and sends a message without any manual review step. In an automation skill that interacts with third-party users, this can cause unintended outreach, spam, reputational damage, or policy violations if triggered with the wrong template or context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README describes automation that clicks, scrolls, captures screenshots, and sends messages, but it does not clearly warn that these actions will control the user's GUI and can affect whatever application is in focus. That omission increases the chance of accidental interaction with the wrong window, unintended data capture, or misdirected actions on the local system.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly directs generated messaging to use natural Chinese expression and the example output is only in Chinese, with no opt-in or language selection. This is a natural-language locale constraint that can violate policy when a specific language is forced without user choice or a documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code file contains user-facing natural-language strings exclusively in Chinese, including the module docstring, CLI description, help text, and examples. Under the stated policy, forcing a specific language without offering a language choice or documenting a justified locale constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: capture_screenshot is documented as taking a screenshot and returning its path, but before capturing it also calls Path(path).parent.mkdir(...), which modifies the filesystem. This is a real side effect not reflected in the function documentation, creating a small intent/documentation mismatch.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The natural-language comment "Boss 直聘职位沟通自动化依赖" presents the skill context entirely in Chinese and targets a Chinese hiring platform, but the file does not indicate that the language/locale is optional or region-specific by design. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.