xinjianxue-skill-job_change-cn

• Outcome: Review
• Latest audit: Sep 14, 2026 · 1:10 PM UTC
• Version: 2.1.0

Overview

The skill is a disclosed paid career-analysis connector, but it asks users to paste a sensitive one-time account authorization code into chat and sends identifying personal details to an external service.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:125
• Finding: Sensitive One-Time Authorization Code Collected Through the Conversation## Vulnerability Details **File Location**: `SKILL.md`, lines 125-140 **Vulnerability Type**: Sensitive credential exposure through conversational input **Risk Level**: High ### Evidence The following is an English translation of the audited instruction segment: ```markdown ### Step 2: Ask the user for the Xinjianxue AI authorization code and complete binding The AI must stop and ask the user for the Xinjianxue AI authorization code. It is a one-time credential and may only be used to bind the license above to the user's account. POST /api/xinjianxue/ai/license/bind { "license": "XJX-AI-xxxxxxxxxxxxxxxx", "auth_code": "<the 8-character code supplied by the user>" } The AI authorization code is a sensitive one-time credential. It is case-sensitive and becomes invalid after binding. ``` ### Technical Analysis The skill explicitly classifies the authorization code as a sensitive one-time credential but requires the user to send it through the AI conversation. Conversation content can pass through model providers, agent middleware, observability systems, debugging traces, and chat-history storage before the credential is redeemed. The later prohibition against exposing credentials in conversations applies primarily to the generated `license_key` and `api_key`; it does not provide a protected input mechanism for the authorization code. Redaction after submission would also be insufficient if upstream components had already logged the original message. Because the binding endpoint accepts an independently obtained license and the user's authorization code, possession of an unredeemed code may allow another party to bind the user's service account to an attacker-controlled AI license. ### Attack Path 1. The skill instructs the user to paste the one-time authorization code into the conversation. 2. An attacker gains access to chat history, telemetry, middleware logs, debugging output, or another co ...[truncated 1154 chars]
• Remediation: ## Remediation Suggestions 1. Replace conversational credential collection with an OAuth-style authorization-code or device-authorization flow. 2. Direct the user to enter the code only on an authenticated page controlled by the service. 3. Return a narrowly scoped, short-lived, revocable binding result to the agent rather than exposing the original code. 4. Bind authorization attempts to the intended license, session, agent identity, and a nonce before displaying the code. 5. Apply strict expiration, one-attempt redemption, rate limiting, and replay protection. 6. Ensure chat systems, middleware, telemetry, and error handlers never receive or log the authorization code. 7. Provide account-side visibility and revocation controls for bound AI licenses. 8. If migration cannot occur immediately, use a dedicated secret-input channel with end-to-end redaction instead of ordinary chat messages.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:199
• Finding: Excessive Personal Data Transmitted to an External Career-Analysis Service## Vulnerability Details **File Location**: `SKILL.md`, line 68 and lines 199-204 **Vulnerability Type**: Excessive collection and external transmission of personal data **Risk Level**: Medium ### Evidence The following is an English translation of the disclosure at line 68: ```markdown Before starting, be aware that the service sends the subject's date and time of birth, gender, birthplace, and current location to chinaapi.xinjianxue.com for processing. ``` The following is an English translation of the complete input-requirement segment at lines 199-204: ```markdown - Complete input: date and exact time of birth, gender, birthplace (country and province, region, or city), and current location. - Basic input: date of birth, gender, and current location. - Both variants require gender, date of birth, and current location. - The complete variant additionally requires exact birth hour and minute and the place of birth. - Multi-person analysis uses a people array where each person has: {name, birth, gender, place, country}. - If the user has not provided all required fields, the AI must ask for the missing information rather than calling the API with missing fields. ``` ### Technical Analysis The skill requires combinations of names, precise birth information, gender, birthplace, and current location to provide job-change guidance. These attributes can form a highly identifying profile, particularly when an exact birth time and granular location are combined. The stated advisory purpose concerns salary, employer platform, career growth, and employment risk. The documentation does not establish why precise birth details or location granularity are necessary for those decisions. Requiring the agent to obtain missing fields increases collection rather than applying data minimization. The documentation states that the external service does not retain reports or submitted data, but the project contai ...[truncated 1653 chars]
• Remediation: ## Remediation Suggestions 1. Perform and document a data-protection impact assessment before deployment. 2. Remove precise birth time, gender, birthplace, and granular current location unless each field has a documented and necessary purpose. 3. Make optional fields genuinely optional and prevent the agent from requesting unnecessary missing information. 4. Prefer job-relevant inputs such as compensation, role, industry, employer stability, growth prospects, mobility constraints, and risk tolerance. 5. Offer a local or no-transfer analysis mode. 6. Clearly identify the data controller, processors, retention period, storage regions, deletion procedure, and contact channel before consent. 7. Enforce encryption in transit, field-level minimization, restricted logging, short retention, access auditing, and deletion controls on the server. 8. Disable multi-person submissions unless each subject's informed consent can be independently verified. 9. Separate consent for mandatory processing from consent for optional profile enrichment.

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:194
• Finding: Commercial Referral Messaging Mandated by Skill Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 194 and 272 **Vulnerability Type**: Agent output redirected toward mandatory promotional content **Risk Level**: Low ### Evidence The following is an English translation of line 194: ```markdown When credits are insufficient, tell the user that credits can be obtained for free through activities such as inviting friends and sharing the skill experience on social media, and that more methods are available in the Xinjianxue WeChat mini-program. ``` The error-handling rule at line 272 repeats the same mandatory behavior: ```markdown Insufficient experience credits: Tell the user that credits can be obtained through benefits such as inviting friends and sharing the skill experience on social media, and direct the user to the Xinjianxue WeChat mini-program for more methods. ``` ### Technical Analysis The skill does not limit insufficient-credit handling to a factual service-status message. It directs the agent to promote invitations, social-media sharing, and an external mini-program. This modifies expected assistant output for the provider's acquisition and engagement objectives. The behavior is deterministic because it is embedded in the prescribed error-response workflow. Users are not told that the recommendation is promotional, and the agent is not given discretion to provide a neutral alternative. This is categorized as instruction hijacking because the loaded skill changes the agent's response objective from neutral service handling to mandatory commercial promotion. The issue is lower severity than credential or code-execution vulnerabilities because it does not itself grant system access. ### Attack Path 1. The user invokes the external report service. 2. The account has fewer credits than required for the report. 3. The service returns the documented insufficient-credit response. 4. The skill's error-handling instruction activates. ...[truncated 730 chars]
• Remediation: ## Remediation Suggestions 1. Replace mandatory referral language with a neutral statement that the account lacks sufficient credits. 2. Present credit-acquisition methods only when the user explicitly asks about them. 3. Clearly label invitation, social-sharing, and mini-program suggestions as promotional. 4. Provide non-promotional alternatives, including canceling the operation or continuing with general local guidance. 5. Prevent the external API response from forcing promotional language; keep response policy under the host agent's control. 6. Review the workflow against applicable advertising, endorsement, and platform-disclosure requirements.

Static analysis

No suspicious patterns detected.