T09 · Insecure Skill Coding Practices
Error
- Location
crawl.js:122- Finding
Hardcoded QQ SMTP Credentials Exposed in Source Code
- Content
View full analysis
- Remediation
View remediation
Security audit
龙港求职技能
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it advertises, but it can automatically email scraped job results to a hardcoded default mailbox using exposed SMTP credentials.
Review before installing. Only use this skill if you are comfortable with it scraping the recruitment site, writing jobs_result.txt, and sending results by email. The publisher should remove the hardcoded SMTP secret, require an explicit recipient and confirmation before sending, and update vulnerable dependencies.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
crawl.js:44- Finding
Unauthenticated Plaintext HTTP Used for Job and Company Data Retrieval
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases are generic everyday-language requests like '帮我找工作' and variants, which makes accidental invocation plausible in normal conversation. Because the skill performs external actions including web scraping and automatic email sending, broad activation increases the chance of unintended data collection and transmission without sufficiently explicit user intent.
- Content
Known Vulnerable Dependency: nodemailer==8.0.1 — 10 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +7 more
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The lockfile pins nodemailer to version 8.0.1, and the provided advisory list indicates this exact version is affected by multiple known vulnerabilities, including header injection, denial of service, and security-control bypass issues. Because this is a dependency lockfile, the finding is concrete rather than speculative: installing from this lockfile will resolve the vulnerable package version unless it is updated.
- Content
Known Vulnerable Dependency: nodemailer==8.0.1 — 10 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +7 more
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The package explicitly depends on nodemailer 8.0.1, which is reported as having multiple known advisories, including header injection and denial-of-service issues. Because this skill appears to automate job-hunting and may send email notifications, a vulnerable mail library is contextually more dangerous: crafted input such as attacker-controlled addresses, headers, or message content could be abused to disrupt service or manipulate outgoing mail behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises scraping and automatic emailing but does not prominently warn users that invoking it may transmit collected job data to an email address, including a default recipient if none is supplied. This weakens informed consent and can lead to unintentional exfiltration of scraped content or personal preference data to a third party.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file is described as a job-search crawler, but it also performs outbound email delivery to a default address, which is behavior not disclosed by the top-level description. This mismatch increases security concern because users or reviewers may believe the skill only scrapes and saves data locally, while it actually transmits the results externally.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script contains built-in outbound email exfiltration of scraped data and allows the recipient to be supplied via command-line input, while also falling back to a hard-coded default recipient. In a crawler skill, this creates an unnecessary data-transfer channel that can silently send collected information off-host without explicit user confirmation, which is especially risky because SMTP credentials are embedded directly in the code.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code emails scraped job and company information without any prior warning, consent prompt, or confirmation, and defaults to sending to a hard-coded address when none is provided. Hidden or automatic outbound transmission is dangerous because it can leak collected data, normalize covert exfiltration patterns, and undermine user expectations about where the data goes.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file's comments, CLI argument prefixes, and user-facing console messages are all fixed in Chinese, which imposes a specific language/locale without any opt-in or alternative. This can violate language-choice policy when the skill is not clearly documented as a China-specific or Chinese-only tool.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script writes scraped results to jobs_result.txt using fs.writeFileSync, but there is no warning before the write occurs; the only notice is printed after the file has already been created. For a safety audit, this lacks upfront disclosure that local filesystem changes will occur during execution.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The package description is written only in Chinese, which can indicate a language-specific constraint in user-facing skill metadata. There is no accompanying opt-in, alternative locale, or documentation showing that this skill is intentionally region-specific for policy or compliance reasons.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Using a caret range for a dependency allows different versions to be installed over time, which reduces build reproducibility and can unintentionally pull in vulnerable or breaking releases. In a security-sensitive skill, this increases supply-chain risk because dependency resolution may change without review.
- Content
json } }, "dependencies": { "nodemailer": "^8.0.1" } }
Static analysis
No suspicious patterns detected.