other
- Location
packages/04-questionbanks.md:405- Finding
Privacy-Invasive Candidate Profiling Through Family and Partner Information
- Content
View full analysis
Vulnerability Details
File Location:
packages/04-questionbanks.md:405
Vulnerability Type: Privacy-invasive candidate profiling
Risk Level: MediumComplete Vulnerable Snippet:
markdown | TR10 | 家人 / 伴侣支持你转行吗？（如有） | 稳定性 | 家人强烈反对且无独立判断 |English translation:
text TR10: Does your family or partner support your career change, if applicable? Assessment dimension: Stability Red flag: Strong family opposition and a lack of independent judgmentTechnical Analysis
The interview question solicits private information about a candidate's family or partner and explicitly uses the response as a negative employment-evaluation signal. This is unrelated to whether the candidate can perform the role and may introduce relationship-status, family-status, and socioeconomic bias into recruitment decisions.
The instruction directly contradicts the Skill's global privacy rules:
SKILL.md:77prohibits evaluating or reporting family members, income, and social relationships.packages/01-framework.md:122repeats the same prohibition and requires such information to be ignored even when candidates disclose it voluntarily.
Because the question bank labels family opposition as a red flag for “stability,” an Agent following the question bank may incorporate prohibited private information into interview scoring, calibration, and final hiring decisions. The resulting rationale may subsequently be preserved in candidate records through the calibration workflow.
Attack Path
- A user requests an interview plan or evaluation for a career-change candidate.
- The Skill routes the request to the career-change question bank.
- The Agent asks question
TR10about the candidate's family or partner. - The candidate discloses private relationship or family information.
- The Agent treats family opposition as a negative stability signal.
- The signal influences the interview report, calibr ...[truncated 1008 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove question
TR10and its family-opposition red-flag criterion. -
Replace it with a strictly job-relevant question, such as:
text What practical challenges do you anticipate during this career transition, and how do you plan to manage them? -
Prohibit questions and scoring criteria concerning family members, partners, marital status, caregiving circumstances, household income, or social relationships.
-
Add an automated policy check that scans question banks, report templates, scoring criteria, and calibration notes for prohibited private attributes before use.
-
Require reviewers to verify that every stability assessment is supported only by job-relevant evidence, such as the candidate's stated plans, demonstrated preparation, and employment history.
-
Remove prohibited information from generated reports and candidate records. If such information has already been collected, apply the organization's deletion and access-control procedures.
-
Add an explicit precedence rule stating that the global privacy restrictions override every downstream question bank and evaluation template.
-