Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
所提供的 shell 命令用于软件工程中的 CI/CD、容器化和部署配置生成，与声明的猎头招聘工作流及人才寻访用途存在实质差异，也没有体现为招聘功能的辅助实现。代码未显示实际执行部署或访问镜像仓库，因此判断限于其明确调用的生成能力。
- Content
Security audit
headhunter-pro
Security checks for vulnerabilities and agentic risk
Overview
This recruiting toolkit needs review because it recommends excessive GitHub permissions and leaves sensitive candidate-data handling and automation boundaries unclear.
Use reviewed drafts until the permission boundaries are clarified. Avoid the recommended broad GitHub token; use narrowly scoped access. Keep real candidate recordings out of unapproved demos, minimize personal information, and define consent, retention and contact preferences. Explicitly approve scheduled monitoring and record removal, using reversible archiving where possible.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (21)
Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 86% confidence
- Finding
The supplied chunk is focused on preparing an ML/audio environment and locating VibeVoice services, rather than implementing recruitment functionality. Audio tooling could support recruitment, but this chunk establishes no such integration or purpose. The only executable action is package installation; it does not itself perform speech processing, access candidate data, or contact the mentioned services.
- Content
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > 📖 完整内容：**📖 [筛选评估与 BEI 深度指南](references/screening-bei-9dim.md)**
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `screening-bei-9dim.md` | 筛选评估与 BEI/9 维度深度指南 |
Instructions to obtain social-insurance and tax records lack sensitive-data privacy warnings.
High
- Category
- Output Handling
- Confidence
- 97% confidence
- Finding
The skill recommends requesting social-insurance or tax records to resolve timeline concerns without specifying necessity, redaction, authorized handling, or retention limits. These documents can expose identifiers, financial information, and unrelated personal details, creating privacy and identity-fraud risks if collected or shared insecurely. The recruiting context makes unnecessary collection plausible, although no exfiltration destination or actual disclosure is shown.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
认证配置：
bash # 方法 1：GitHub Personal Access Token GitHub Settings → Developer Settings → Personal Access Tokens → 生成 token（建议 scope: repo, read:user） export GITHUB_TOKEN="your_personal_access_token"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
认证配置：
bash # 方法 1：GitHub Personal Access Token GitHub Settings → Developer Settings → Personal Access Tokens → 生成 token（建议 scope: repo, read:user） export GITHUB_TOKEN="your_personal_access_token" # 方法 2：GitHub CLI 登录
The quarterly cleanup workflow removes candidate records without warning about potential data loss.
Medium
- Category
- Output Handling
- Confidence
- 90% confidence
- Finding
L1427 instructs the agent to remove candidates who have been unreachable for more than a year. The file does not warn that cleanup could discard candidate profiles or recruitment history, or distinguish reversible archiving from deletion.
- Content
The recommendation-report workflow includes sensitive candidate information without a privacy warning.
Medium
- Category
- Output Handling
- Confidence
- 91% confidence
- Finding
The recommendation-report template explicitly includes birth date, gender, and marital status, creating a risk of unnecessary disclosure of candidate personal information and discriminatory hiring decisions. Restricting inclusion to information supplied by Walter reduces fabrication but does not establish candidate consent, recipient authorization, or job-related necessity. The recruitment context makes onward sharing plausible, although this file does not itself transmit data or identify an unauthorized recipient.
- Content
The recommendation to try an online Playground lacks a warning about disclosing candidate recordings or reports to third parties.
Medium
- Category
- Output Handling
- Confidence
- 94% confidence
- Finding
The skill recommends trying online voice-processing Playgrounds in a workflow explicitly involving candidate call recordings and recommendation reports, without requiring privacy review or restricting testing to synthetic data. Following that advice with real recruiting material could disclose personal information, confidential employment discussions, and identifiable voices to an unapproved third party with unknown retention practices. This is an unsafe data-handling recommendation rather than evidence of deliberate exfiltration; the local-processing option reduces, but does not eliminate, the risk.
- Content
The workflow instructs retaining sensitive candidate information without a privacy warning.
Medium
- Category
- Output Handling
- Confidence
- 91% confidence
- Finding
The workflow directs recruiters to retain candidates’ written reasons for leaving, including signed or WeChat records, without specifying informed consent, access restrictions, or retention limits. These records can reveal confidential workplace disputes and personal circumstances; unauthorized disclosure could harm candidates’ employment relationships or negotiating position. Collecting some career-preference information is legitimate in recruitment, but retaining identifiable, potentially sensitive explanations without safeguards creates an avoidable privacy risk rather than evidence of malicious collection.
- Content
The candidate-submission workflow lacks a privacy warning before sharing candidate information with clients.
Medium
- Category
- Output Handling
- Confidence
- 92% confidence
- Finding
The Submitted stage directs the agent to provide a candidate recommendation report to a client, making this an operational workflow step rather than a tool listing. The report checklist includes salary details and reasons for considering a move (L188–L189), but the file provides no warning about disclosing this sensitive candidate information to a third party.
- Content
The instruction to build a reusable candidate database lacks a privacy warning.
Medium
- Category
- Output Handling
- Confidence
- 90% confidence
- Finding
The file instructs the agent to create a reusable talent database tagged with candidate attributes, including location, language, and willingness to relocate abroad. This entails retaining personal profiles, but the document provides no warning about privacy implications or guidance on authorization, access, and retention.
- Content
The high-risk response instructs immediate consultant notification without warning about disclosure of sensitive employee information.
Medium
- Category
- Output Handling
- Confidence
- 90% confidence
- Finding
The workflow directs the agent to notify a consultant when signals include serious dissatisfaction with leadership or looking for outside opportunities. It provides no privacy warning or guidance on consent and disclosure limits, despite the potential employment consequences of sharing these signals.
- Content
Mandatory background checks lack a warning about accessing or sharing candidates’ personal information.
Medium
- Category
- Output Handling
- Confidence
- 91% confidence
- Finding
The workflow requires education, employment-history, and non-compete checks for core positions and names external screening providers as an option. It does not warn that these checks involve sensitive candidate information or instruct the agent to establish authorization before obtaining or sharing that information.
- Content
The candidate-retention workflow lacks privacy and contact-preference safeguards.
Medium
- Category
- Output Handling
- Confidence
- 89% confidence
- Finding
The workflow instructs updating unsuccessful candidates’ records with rejection reasons and conducting repeated outreach over subsequent months. It provides no warning about retaining and reusing candidate information for future recruitment, nor instructions to check retention authorization or respect contact opt-outs.
- Content
Continued and automated outreach lacks a warning to respect opt-outs and contact preferences.
Medium
- Category
- Output Handling
- Confidence
- 91% confidence
- Finding
The Warm Keep section encourages continued contact after rejection without distinguishing temporary lack of interest from an explicit opt-out. The broader file adds recurring, multichannel outreach and automated follow-up without a contact-preference or suppression check, increasing the risk of unwanted messaging, privacy complaints, and regulatory or platform-policy violations. This is a missing workflow safeguard, not evidence of malicious intent or implemented unauthorized messaging.
- Content
The background-check workflow omits a warning about disclosing a candidate's job search to reference contacts.
Medium
- Category
- Output Handling
- Confidence
- 94% confidence
- Finding
The background-check workflow directs verification with supervisors, colleagues, subordinates, and external partners without requiring candidate authorization or distinguishing current-employer contacts. In an end-to-end recruiting skill, following this workflow could disclose a confidential job search, exposing the candidate to retaliation, reputational damage, or employment consequences; the text does not establish that unauthorized outreach actually occurs.
- Content
The workflow directs retention and reuse of candidate information without a privacy warning.
Medium
- Category
- Output Handling
- Confidence
- 90% confidence
- Finding
These steps instruct the agent to record candidates and rejection reasons in a talent pool, scan those records quarterly, and initiate renewed outreach. The file does not warn that this retains and repurposes personal recruitment information for future contact.
- Content
GitHub authentication instructions recommend broad repository permissions without warning about their security impact.
Medium
- Category
- Output Handling
- Confidence
- 97% confidence
- Finding
The instructions recommend the classic GitHub token scope
repofor a workflow primarily concerned with searching public repositories and contributors. That scope can grant broad access to private repositories, including write capabilities, so a leaked token or a tool using it improperly could compromise repositories unrelated to recruiting. Legitimate GitHub authentication is expected here, but these permissions substantially exceed the demonstrated need.- Content
The sourcing workflow collects and infers candidates’ contact details without a privacy warning.
Medium
- Category
- Output Handling
- Confidence
- 97% confidence
- Finding
The automated sourcing workflow explicitly collects or infers contact details from profiles, commit emails, and linked social accounts, then incorporates candidate information into generated briefs. Public availability does not establish permission for unrestricted aggregation or outreach; without privacy controls, this can expose personal contact information, propagate mistaken identity matches, and enable unwanted contact at scale. Recruiting provides a legitimate purpose, but the workflow does not specify collection limits, retention rules, or opt-out handling.
- Content
Static analysis
No suspicious patterns detected.