boss直聘自动化（无GUI）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:32 AM UTC
• Version: 1.0.0

Overview

This skill controls the live desktop to send job-platform messages and includes weak safeguards plus guidance to exaggerate qualifications.

Review carefully before installing. In its current form, run it only in an isolated environment and only after changing it to draft messages, remove qualification-exaggeration guidance, require explicit approval before every send, verify the active Boss Zhipin page and recipient, add limits, and define screenshot retention.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: main.py:244
• Finding: Unverified fixed-coordinate automation can capture or interact with unintended applications<![CDATA[ ## Vulnerability Details **File Location**: `main.py:244-252`, `main.py:280-282`, `boss_automation.py:144-211` **Vulnerability Type**: Unvalidated GUI automation and unintended action execution **Risk Level**: High ### Vulnerable Code `main.py:244-252`: ```python # 3. Screenshot capture_screenshot(config=cfg) # 4. Communication workflow (automatically executed without manual confirmation) log_step("Execute communication workflow") click_chat_button(config=cfg) activate_chat_input(config=cfg) send_chat_message(config=cfg) browser_go_back(config=cfg) ``` `main.py:280-282`: ```python while True: process_job(cfg) time.sleep(1) ``` `boss_automation.py:144-211`: ```python def click_job_item(self): """Click a job item in the job list.""" pyautogui.moveTo(self.job_start[0], self.job_start[1], duration=0.5) time.sleep(0.3) pyautogui.click(self.job_start[0], self.job_start[1]) self._random_delay() def capture_job_description(self, save_path=None): """ Capture the job-description area. Parameters: save_path: Optional screenshot destination. Returns: PIL.Image: Screenshot object. """ region = self.screenshot_region x1, y1, x2, y2 = region width = x2 - x1 height = y2 - y1 screenshot = pyautogui.screenshot(region=(x1, y1, width, height)) if save_path: screenshot.save(save_path) self._random_delay() return screenshot def click_chat_button(self): """Click the immediate-chat button.""" pyautogui.moveTo(self.chat_button[0], self.chat_button[1], duration=0.5) time.sleep(0.3) pyautogui.click(self.chat_button[0], self.chat_button[1]) self._random_delay() def activate_chat_input(self): """Activate the chat input.""" pyautogui.moveTo(self.chat_input[0], self.chat_input[1], duration=0.5) time.sleep(0.3) pyautogui.click(self.chat_input[0], self.chat_input[1]) self._random_delay() def browser_go_back(self): """Navi ...[truncated 3219 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Verify the foreground process, window title, and expected browser origin before every screenshot, click, paste, and keyboard action. 2. Confirm that the current URL is the configured Boss Zhipin domain and reject redirects or unexpected pages. 3. Replace fixed coordinates with element-aware browser automation or validated image recognition. 4. Implement the documented OCR and matching stages as mandatory gates before initiating communication. 5. Display the selected job, recipient, and generated message and require explicit user confirmation before pressing Enter. 6. Add a dry-run mode that records intended actions without clicking or sending. 7. Bound the processing loop by job count, runtime, and message count, and apply a conservative rate limit. 8. Abort immediately when window focus, screen resolution, page structure, or target recognition differs from the expected state. 9. Keep the PyAutoGUI fail-safe enabled, but treat it only as an emergency control rather than target validation. 10. Avoid taking or retaining screenshots unless required; restrict permissions on the output directory and provide automatic retention limits. ]]>

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:4
• Finding: Unpinned and unnecessary dependencies create avoidable supply-chain exposure<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:4-11`, `.gitignore:30`, `SKILL.md:25-34` **Vulnerability Type**: Non-reproducible dependency resolution and excessive third-party dependency scope **Risk Level**: Medium ### Vulnerable Code `requirements.txt:4-11`: ```text pyautogui>=0.9.5 pyperclip>=1.8.2 Pillow>=10.0.0 # Optional dependencies pytesseract # If using pytesseract OCR easyocr # If using easyocr OCR paddleocr # If using paddleocr OCR ``` `.gitignore:30`: ```text package-lock.json ``` `SKILL.md:25-34`: ```bash pip install pyautogui>=0.9.5 pyperclip>=1.8.2 Pillow>=10.0.0 ``` ```bash cd skills/ocr-local npm install ``` ### Technical Analysis The Python dependencies use lower-bound constraints or no constraints. Consequently, each installation may resolve to different package versions that were not reviewed with this project. The requirements also list three optional OCR packages that are not imported or used by the included Python implementation. These packages can introduce large transitive dependency trees without providing functionality to the audited workflow. The documentation instructs users to execute `npm install` in an external `skills/ocr-local` component that is not present in this project. At the same time, `package-lock.json` is ignored, preventing reproducible npm resolution if that component is later placed in or developed alongside the project. There is no evidence that any currently named dependency is intentionally malicious. The issue is that mutable, unnecessary, and externally supplied dependency resolution increases exposure to future compromised releases, dependency substitution, or unreviewed transitive code. ### Attack Path 1. A user follows the installation instructions and runs `pip install -r requirements.txt`. 2. The package manager resolves the newest versions satisfying the broad constraints, including unused OCR packages and their transitive dependencies. 3. If a future r ...[truncated 1186 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `pytesseract`, `easyocr`, and `paddleocr` unless the included implementation actually uses them. 2. Pin every direct dependency to an exact reviewed version. 3. Generate hashes for Python packages and enforce hash verification during installation. 4. Use a dependency-locking tool such as `pip-tools`, Poetry, or an equivalent reproducible workflow. 5. Commit `package-lock.json` or another supported npm lockfile rather than ignoring it. 6. Use `npm ci` against the committed lockfile instead of unrestricted `npm install`. 7. Include the required OCR component in the reviewed package or document an exact trusted repository, revision, and integrity verification procedure. 8. Disable dependency lifecycle scripts where they are unnecessary, or review all required lifecycle scripts before installation. 9. Run installation in an isolated virtual environment or container without administrative privileges. 10. Add automated dependency vulnerability and provenance scanning to the release process. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

Credential Access

High

• Category: Privilege Escalation

Content

*.so

# User-specific
.env
.pytest_cache/
.hypothesis/
.vscode/

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: The document states that generated outreach should 'appropriately exaggerate' technical qualifications and imitate human language habits, which directly promotes deceptive self-presentation. In a job application automation context, this is dangerous because it facilitates fraud, misrepresentation, and trust manipulation at scale.

Ssd 4

High

• Confidence: 99% confidence
• Finding: The messaging guidance explicitly tells users to exaggerate qualifications and imitate natural human language, which is direct support for deceptive impersonation in outbound communication. This is especially dangerous in a recruiting context because it facilitates fraud, misrepresentation, and trust manipulation toward real human recipients.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Automated message sending to employers occurs with no confirmation, preview, rate limit, or safety interlock. In this skill’s context, that directly enables unsolicited bulk outreach and accidental messaging, which can violate platform rules, damage accounts, and contact real third parties without operator intent at the moment of send.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The file describes screenshot capture and OCR processing of on-screen job content without warning that visible data may include sensitive or personal information. Because screen capture tools can inadvertently collect unrelated on-screen content, the omission increases privacy and data-handling risk for users and third parties.

Ssd 4

Medium

• Confidence: 96% confidence
• Finding: The combined workflow links qualification exaggeration, human-like phrasing, strong expression of interest, and automated send actions into a scalable deceptive outreach pipeline. This increases risk beyond isolated wording issues because it operationalizes trust-building deception and mass unsolicited messaging in a recruiting context.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document explicitly describes automated clicking, pasting, and sending of messages on the user's behalf, but provides no warning, confirmation requirement, or consent boundary. In the context of a job-platform automation skill, this creates a real risk of unauthorized outreach, spam, and unintended account actions if the automation runs without clear user review.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README describes automation that clicks, scrolls, captures screenshots, and sends messages, but it does not clearly warn that these actions will control the user's GUI and can affect whatever application is in focus. That omission increases the chance of accidental interaction with the wrong window, unintended data capture, or misdirected actions on the local system.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The generation rules instruct the skill to imitate natural human language habits using fluent Chinese expression. This is a locale/language constraint presented as mandatory behavior, and the README does not indicate that users can choose another language or opt into Chinese-only operation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill automates clicking, browsing, and message sending on a third-party job platform, but the description does not warn users that it can take real actions through their account. That omission increases the risk of unintended outreach, account misuse, and violation of platform rules because operators may not realize the automation has externally visible effects.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill captures screenshots of job pages and runs OCR over their contents without any privacy notice, data-handling guidance, or retention limits. This can expose job-posting data, recruiter information, and potentially sensitive page content to local storage or downstream processing without informed user consent.

Ssd 4

Medium

• Confidence: 93% confidence
• Finding: The documented workflow systematically screens targets, generates tailored persuasive content, and automatically initiates contact on a third-party platform. In context, this is more dangerous because it operationalizes scaled outbound manipulation and spam-like behavior, reducing human review before messages are sent and enabling misuse for deceptive mass outreach.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module docstring describes scrolling, clicking, screenshots, and navigation, but omits the script’s ability to paste and send messages automatically. This understates the automation’s real capability, which can mislead downstream users or orchestrators into invoking a tool that can perform outbound communications without clear disclosure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The paste_and_send function performs clipboard paste and immediately sends the message with Enter, without any confirmation, preview, recipient verification, or rate limiting. In a GUI automation context, focus mistakes or malicious orchestration could cause unintended messages to be sent to the wrong party, potentially leaking sensitive clipboard contents or enabling spam/phishing at scale.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file content is a fixed Chinese message and provides no indication that another language can be selected. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

log_step(f"执行 OCR: {image_path}")
    
    try:
        result = subprocess.run(
            ['node', str(ocr_script), '--image', image_path],
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The description says the skill automates job browsing, OCR analysis, and communication, but it does not define clear activation boundaries, consent requirements, or limits on when automated messaging should occur. In a skill that can read on-screen job content and initiate chats, vague scope increases the chance of unintended outreach, over-broad data collection, or misuse beyond the user's explicit intent.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The manifest uses a Chinese-only job platform description and fixes OCR processing to simplified Chinese plus English, with no indication that users can choose another language or locale. This creates a natural-language locale constraint that is not presented as optional or explicitly justified as a region-specific tool.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The file's natural-language interface and operational messaging are entirely in Chinese, including the skill description and runtime logs, with no indication that users can select another language. This can violate language/locale policy when a skill imposes a specific language without user opt-in.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The function description suggests a simple single-job processing flow, but the implementation automatically initiates employer contact and sends a message without any manual review step. In an automation skill that interacts with third-party users, this can cause unintended outreach, spam, reputational damage, or policy violations if triggered with the wrong template or context.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The README describes automation that clicks, scrolls, captures screenshots, and sends messages, but it does not clearly warn that these actions will control the user's GUI and can affect whatever application is in focus. That omission increases the chance of accidental interaction with the wrong window, unintended data capture, or misdirected actions on the local system.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The skill explicitly directs generated messaging to use natural Chinese expression and the example output is only in Chinese, with no opt-in or language selection. This is a natural-language locale constraint that can violate policy when a specific language is forced without user choice or a documented justification.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: This code file contains user-facing natural-language strings exclusively in Chinese, including the module docstring, CLI description, help text, and examples. Under the stated policy, forcing a specific language without offering a language choice or documenting a justified locale constraint is a natural-language policy violation.

Intent-Code Divergence

Low

• Confidence: 87% confidence
• Finding: `capture_screenshot` is documented as taking a screenshot and returning its path, but before capturing it also calls `Path(path).parent.mkdir(...)`, which modifies the filesystem. This is a real side effect not reflected in the function documentation, creating a small intent/documentation mismatch.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The natural-language comment "Boss 直聘职位沟通自动化依赖" presents the skill context entirely in Chinese and targets a Chinese hiring platform, but the file does not indicate that the language/locale is optional or region-specific by design. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy concern.

Static analysis

No suspicious patterns detected.