ClawHub

recruitment-fullstack-v4

Security checks across malware telemetry and agentic risk

Overview

This is a recruiting evaluation skill with useful safeguards, but a key final-decision module is visibly corrupted, which is risky for employment decisions.

Review and repair the corrupted final-decision file before relying on this skill. Use it only with explicit recruiter or hiring-manager direction, keep candidate data access limited, verify all recommendations manually, and ensure local hiring-law, privacy, retention, and anti-discrimination requirements are followed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The activation phrases are broad, generic recruiting requests such as '筛选简历' or '评估候选人', which can match ordinary conversation and cause the skill to trigger without clear user intent. In a hiring workflow, unintended activation can steer the assistant into a structured evaluation mode prematurely, producing employment-related recommendations or handling candidate data when the user only wanted light assistance.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The skill is authored entirely in Chinese and defines Chinese-language output templates without any mechanism to detect or honor the user's preferred language. This can cause misunderstanding of hiring criteria, risk flags, and decision outputs, especially in multilingual environments where recruiters or candidates rely on English or another language for accurate interpretation.

Context Window Stuffing

Medium
Category
Memory Poisoning
Content
### 鏍囧噯鍏紡锛堥€傜敤浜庣粷澶у鏁板矖浣嶏級

```
鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?缁煎悎鍒嗭紙0-5锛?
  绠€鍘嗗姞鏉冨垎 / 3 脳 5 脳 0.15 [绠€鍘? 15%]
  + 闈㈣瘯 BARS 缁煎悎鍒?脳 0.60 [闈㈣瘯: 60%]
  + 杩介棶娣卞害璇勫垎 / 4 脳 5 脳 0.10 [杩介棶娣卞害: 10%]
Confidence
82% confidence
Finding
鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲

Context Window Stuffing

Medium
Category
Memory Poisoning
Content
+ 闈㈣瘯 BARS 缁煎悎鍒?脳 0.60 [闈㈣瘯: 60%]
  + 杩介棶娣卞害璇勫垎 / 4 脳 5 脳 0.10 [杩介棶娣卞害: 10%]
  + 鏂囧寲鍖归厤璇勫垎 脳 0.10 [鏂囧寲鍖归厤: 10%]
鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?
娉細
鈥?绠€鍘嗗垎鍘熸湰 0-3锛屽綊涓€鍖栧埌 0-5
鈥?杩介棶娣卞害鍘熸湰 0-4锛屽綊涓€鍖栧埌 0-5
Confidence
83% confidence
Finding
鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal