xinjianxue-skill-career_plan-global

• Outcome: Review
• Latest audit: Sep 14, 2026 · 3:14 PM UTC
• Version: 1.0.1

Overview

This skill is not malware, but it should be reviewed because it asks for a sensitive account-binding code and sends detailed personal profile data to a paid third-party API under a career-advice label.

Install only if you are comfortable sharing birth details, gender, location, and a one-time account authorization code with this service, and with the agent storing service credentials for later paid API calls. Verify the domain independently, avoid using this for other people without consent, and treat token top-up or referral prompts as third-party commercial guidance rather than neutral advice.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:133

Finding

Sensitive Account-Binding Credential Solicited Through Chat

Content

View full analysis

"Open the official website **www.xinjianxue.com → sign in → "Personal Center" (个人中心) → "AI Assistant Authorization Code" (AI 助手授权码)**, and send me the 8-character authorization code shown there; I need it to complete the account binding. > Reminder: this code is a **sensitive one-time credential** that is voided the moment the binding succeeds — please confirm you are talking to the official XinJianXue AI assistant (service domain `www.xinjianxue.com`) and send it only to me, this one AI; do not post it in a group chat, do not screenshot or share it, and do not give it to any other AI." `POST /api/xinjianxue/ai/license/bind` with body: ```json { "license": "XJX-AI-xxxxxxxxxxxxxxxx", "auth_code": "" } ``` On success it returns `api_key` (the business credential). > ⚠️ **The AI authorization code is a sensitive one-time credential** (8 characters, case-sensitive); it is voided once binding succeeds, and **it may only be used for this one binding**. ``` ### Technical Analysis The Skill explicitly requires the user to submit a sensitive account-binding credential through an ordinary conversational channel. Although the credential is single-use, its inclusion in model context may expose it to conversation retention, telemetry, host-level logging, browser extensions, monitoring systems, or any party with transcript access. The warning that the code is sensitive does not prevent its plaintext presence in the conversation. Because successful use binds an AI license to the user's accoun ...[truncated 1397 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:74

Finding

Sensitive Personal Data and API Credentials Are Sent to a Third-Party Report Endpoint

Content

View full analysis

⚠️ **Before you start**: calling this service sends personal information about the subject — date of birth (plus time, if known), gender, place of birth, current location — to the XinJianXue API (`www.xinjianxue.com`) for processing; it is used only for this one analysis and is not stored. This AI calls under your account identity and consumes tokens per call. **Please confirm you understand and agree before starting.** ``` ```markdown > ⚠️ Where the credentials go (per the server implementation; the three entry points differ): > - Item 5 (report): **`api_key` must be in the body** (the report logic reads only the body); `license` may go in the body or in a header. > - Item 4 (bill): GET has no body, so **both credentials can only go in headers**. > - Item 3 (verify): body or headers, either works. ``` ```markdown - **Both tiers must provide**: gender, date of birth (if the user knows the time of birth, include it and the call is automatically upgraded to tier a), and the subject's current location (country + state/region/city) - **Tier a additionally requires**: the exact hour + minute of birth, and the place of birth (country + state/region/city) - **Multi-person analysis**: pass a `people` array, each person `{name, birth, gender, place, country}`. - ⚠️ If the user has not supplied everything, the AI must ask for the missing pieces first — never call with parameters missing. Example request body: ```json { "license": "XJX-AI-xxxxxxxxxxxxxxxx", "api_key": "", "birth": "1990-01-01 08:30", "gender": "Female", "country": "United States", "place": "New York City", "current_country": "United States", "current_place": "New York City" } ``` ``` ### Technical Analysis The Skill tran ...[truncated 2314 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:198

Finding

Skill Forces Commercial Cryptocurrency and Referral Messaging After Quota Exhaustion

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is labeled and positioned as a Career Planning Advisor, but its documented API behavior centers on personality, relationship, and emotional-state analysis. This scope mismatch can mislead users and hosts about what data is collected and what kind of profiling occurs, undermining informed consent and enabling sensitive psychological processing under a less alarming label.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

Call `POST /api/xinjianxue/ai/license/verify` (include credentials if you have them; body or headers are both accepted). **The only criterion is `pass`:**

- `pass: true` → **already onboarded**: use the APIs directly, and do not ask the user for any credential.
- No credentials / `pass: false` → act on the returned `msg`; **go to Step 1 only once you have confirmed "never onboarded"**. Do not blindly re-apply (re-applying produces an extra license that nobody uses).

### Step 1: Apply for the AI business license (once only)

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill includes an endpoint for billing-history access that is not necessary for delivering career-planning advice. Even if limited to the user's own account, exposing account usage and token history expands the skill's access beyond least privilege and creates unnecessary privacy and data-exposure risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.