Security audit

Agenhire

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed job and hiring automation tool, but it can take real employment actions with broad account authority and uses risky unpinned command-based setup.

Install only if you deliberately want an AI agent to act in your job-seeker or employer account. Use a dedicated, least-privilege API key, avoid pasting real keys into chat or shell commands, pin and verify the npm package before running the MCP server, set strict dealbreakers and daily limits, and require human review before applications, interview answers, offers, job postings, or deposits are submitted.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: README.md:27
Finding: Unpinned npm packages are downloaded and executed through npx
Content: View full analysis
npx agenhire apply npx agenhire applications npx agenhire interviews list npx agenhire interviews submit --file answers.json npx agenhire offers respond --action ACCEPT npx agenhire offers negotiate --salary 7000000 --message "Based on my experience..." npx agenhire employer setup --company "Acme Corp" --country SG --currencies USD,SGD npx agenhire employer verify-email hr@acme.com npx agenhire employer verify-email-confirm hr@acme.com --code 123456 npx agenhire jobs create --file job.json npx agenhire jobs activate ``` ### Technical Analysis The documented commands ask `npx` to resolve and execute packages from the npm registry without specifying an exact reviewed version or integrity hash. The MCP configuration additionally uses `-y`, which automatically accepts package installation without an interactive confirmation. Consequently, the executable selected at runtime can differ from the package version that existed when this skill was reviewed. A compromised maintainer account, malicious package update, dependency-chain compromise, or p ...[truncated 1913 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:124
Finding: Bearer API key is accepted directly as a command-line argument
Content: View full analysis
— Override API key for a single command ``` ### Technical Analysis The AgentHire API key is a bearer credential. Supplying a real key through `--key` places the secret in the command-line argument vector. Depending on the operating system, shell, terminal, and automation environment, that value may be exposed through: - Shell history files. - Process-listing and process-monitoring interfaces. - Terminal session recording. - CI/CD logs and command tracing. - Error reports or diagnostic telemetry that captures invocation arguments. - Parent-process or local monitoring tools. Anyone obtaining the key can authenticate without an additional password or cryptographic proof. The exact available operations depend on whether the exposed key is a candidate or employer key. ### Attack Path 1. A user replaces the placeholder with a valid key and executes: ```bash npx agenhire auth login --key ah_cand_real_secret ``` 2. The shell stores the command in history, an automation system logs the command, or another authorized local process captures its argument vector while it is running. 3. An attacker with access to that history, log, monitoring output, or local process metadata extracts the bearer key. 4. The attacker sends requests with: ```http Authorization: Bearer ah_cand_real_secret ``` 5. The AgentHire API treats the attacker as the credential owner until the key is revoked or rotated. ### Impact Assessment For a candidate credential, unauthorized operations may include reading or changing profile and resume data, submitting job applications, ...[truncated 597 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (33)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README states that the AI can complete interviews by answering technical and behavioral questions on the user's behalf, but does not frame this with a strong safety and consent warning. This is dangerous because it enables deceptive impersonation in hiring workflows, may violate employer policies, and can materially harm the user if inaccurate or fabricated answers are submitted.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The recommended work loop instructs the agent to apply automatically to jobs based on score thresholds, which are real external actions that affect the user's professional identity and relationships. Without an explicit user-facing warning and authorization boundary, an agent could submit unwanted applications at scale, causing reputational harm, privacy leakage, and loss of user control.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The quick-start examples encourage users to register and find jobs without a prominent warning that the agent may autonomously apply to jobs and submit generated content on their behalf. This can lead to unintended impersonation, misrepresentation, or unauthorized submissions if users invoke the skill without understanding its automation scope.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to execute an unpinned package via npx clawhub install agenhire, which implicitly trusts the latest published package at install time. If the package, dependency chain, or publisher account is compromised, users could execute attacker-controlled code during installation or startup.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The employer workflow describes automation that can send interview questions, score candidates, and send offers, but the description does not prominently warn about the risks of automated decision-making and outbound employer actions. In hiring contexts this can create compliance, fairness, and authorization issues, especially if users do not realize the extent of autonomous communications and candidate evaluation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: The README instructs users to run an unpinned package via npx clawhub install agenhire, which allows whatever package version is current at execution time to run code on the user's machine. This creates supply-chain risk: a compromised upstream package, typo-squatted dependency, or malicious future release could execute arbitrary code during install.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 47)May include surrounding context.
无需 SDK，注册获取 API 密钥：

bash
curl -X POST https://agenhire.com/api/v1/agents/register \ -H "Content-Type: application/json" \ -d '{"type": "CANDIDATE", "lang": "zh", "countryCode": "CN"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.zh.md (reported line 47)May include surrounding context.
无需 SDK，注册获取 API 密钥：

bash
curl -X POST https://agenhire.com/api/v1/agents/register \ -H "Content-Type: application/json" \ -d '{"type": "CANDIDATE", "lang": "zh", "countryCode": "CN"}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill describes autonomous job application behavior but does not present a clear, up-front warning that the agent may submit applications on the user's behalf using generated content. In a hiring context, this can cause unauthorized or poorly reviewed submissions, reputational harm, privacy leakage in application materials, and unintended commitments before the user realizes the degree of automation.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The example conversation tells the user to paste their API key into chat so the agent can act on their behalf. Requesting secrets in-band increases the chance of credential exposure through chat logs, model retention layers, screenshots, copy/paste mistakes, or other intermediaries.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The skill instructs users to launch an MCP server via npx agenhire without pinning an exact package version. This allows whatever version is currently published under that name to be fetched and executed, creating a supply-chain risk if the package is compromised, typosquatted, or updated maliciously.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This invocation uses npx to fetch and execute agenhire without a pinned version. In an agent/MCP context, that means arbitrary new code may run locally with access to configured credentials and tooling if the upstream package changes or is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The CLI example executes npx agenhire without version pinning. Because npx resolves remote package code at runtime, users may execute unintended code if the npm package is replaced, hijacked, or maliciously updated.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This command also relies on an unpinned npx package execution path. In security-sensitive tooling that handles API keys, unpinned package execution increases the likelihood of credential theft or arbitrary code execution via the package supply chain.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The skill shows another npx agenhire command without an exact version. Repeated examples normalize insecure execution practices and increase the chance that users run unreviewed code directly from the registry.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This unpinned runtime package invocation presents the same supply-chain exposure as the other npx examples. Since the tool is intended to interact with accounts and credentials, compromise could affect both local systems and external platform actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: Running npx agenhire without version pinning permits execution of whatever code npm serves at invocation time. In practice, this creates a realistic software supply-chain risk for users following the documentation verbatim.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This is another instance of unpinned npx execution in the skill. The danger is amplified because the commands are operational and likely to be copied directly by users or agents with active credentials.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The unversioned CLI example exposes users to package substitution or malicious update risk. A compromised package could exfiltrate API keys, tamper with job applications, or execute arbitrary code on the host.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This example continues the pattern of executing an unpinned npm package at runtime. In agent workflows, that can lead to compromise of both the local environment and the user's platform account if the fetched code is malicious.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: Another unpinned npx agenhire invocation creates avoidable supply-chain risk. The skill context makes this more dangerous because the tool handles authentication and can trigger real external actions like applications and offers.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The command fetches and runs an npm package without version constraints. If the upstream package changes unexpectedly, users may unknowingly execute code with access to tokens and sensitive profile data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This line repeats the insecure pattern of floating npx execution. Such examples are especially risky in a skill because automated systems may translate them directly into executable setup steps.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The employer command example still uses npx agenhire without a fixed version, preserving the same supply-chain attack path. An attacker controlling the package release could manipulate employer actions, listings, or escrow/deposit operations.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This unpinned package execution is a true security concern rather than mere style, because it can cause direct arbitrary code execution through npm. The account-management and payment-adjacent functions described in the skill increase the stakes.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:210