Scrapling Boss Recruitment

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 0.1.0

Overview

This recruitment scraping skill asks users for live Boss Zhipin session cookies and handles candidate resume data with too little scoping, disclosure, or user control.

Install only if you are comfortable granting the skill authenticated access to your Boss Zhipin account and processing candidate personal data. Do not paste all browser cookies into prompts or shared files, prefer a dedicated account or sanctioned API flow, avoid remote LLM parsing unless you have consent and retention controls, and require manual review before any batch outreach.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:22-26
Vulnerability Type: Supply-chain exposure through an unpinned dependency
Risk Level: Medium

bash

pip install scrapling

Technical Analysis

The installation instructions retrieve and install whichever version of scrapling is current at execution time. No reviewed version, package hash, lock file, or trusted index configuration is specified. Consequently, the code installed by users may differ from the code reviewed during this audit.

This does not establish that the current dependency is malicious. However, it creates a supply-chain trust gap: a compromised upstream account, malicious future release, dependency takeover, or unexpected package resolution could introduce arbitrary installation-time or runtime behavior.

Attack Path

1. An attacker compromises the upstream package, its publishing credentials, or a transitive dependency.
2. The attacker publishes a malicious package release.
3. A user follows the documented pip install scrapling instruction.
4. Package installation or import executes attacker-controlled code in the user's Python environment.
5. That code operates with the privileges of the user running the installation or Skill.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's privileges. Depending on the environment, this could expose Boss Zhipin authentication cookies, candidate resume data, environment variables, local files accessible to the user, and network credentials. The Skill itself does not request administrative privileges, so the direct scope is limited to the installing user's permissions unless the installation command is run with elevated privileges.

Remediation

View remediation

Remediation Suggestions

• Pin scrapling to a specifically reviewed version.
• Maintain a lock file covering all transitive dependencies.
• Require package hashes, such as through pip install --require-hashes.
• Configure installation to use an explicitly trusted package index.
• Run dependency vulnerability and provenance checks in CI.
• Install dependencies inside a dedicated virtual environment or restricted container.
• Avoid running package installation with administrative privileges.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/config.md:17

Finding

Overcollection and Unrestricted Forwarding of Authentication Cookies

Content

View full analysis

Vulnerability Details

File Location: references/config.md:17-40; authenticated forwarding occurs at scripts/boss_scraper.py:123 and scripts/boss_scraper.py:165
Vulnerability Type: Excessive secret collection and non-minimal credential handling
Risk Level: Medium

The configuration guide identifies two cookies as required but also recommends supplying all visible cookies. Its example includes authentication tokens, session identifiers, user identifiers, tracking values, and device fingerprints:

python

COOKIES = {
    '__zp_stoken__': 'your_stoken_here',
    '__zp_phoenix_id': 'your_phoenix_id_here',
    'Hm_lvt_194a310...': 'timestamp',
    'Hm_lpvt_194a310...': 'timestamp',
    'wt': 'your_wt_here',
    'l': 'your_l_here',
    'wmda_uuid': 'your_uuid_here',
    'wmda_new_uuid': 'your_new_uuid_here',
}

The supplied dictionary is forwarded without an allowlist:

python

with DynamicSession(headless=True, network_idle=True) as session:
    page = session.fetch(url, cookies=self.cookies)

Technical Analysis

Authentication cookies are bearer credentials and may grant access to the user's recruitment account. The documentation encourages collection beyond the two cookies it describes as necessary, while the implementation accepts and forwards every dictionary entry without validation.

The reviewed URL construction fixes the destination to https://www.zhipin.com, and no unrelated exfiltration endpoint was found. Therefore, this is not evidence of intentional credential theft. Nevertheless, collecting every visible browser cookie violates least privilege and unnecessarily exposes session, tracking, and device identifiers to the Python process, the browser automation dependency, debugging facilities, and future code changes.

Attack Path

1. A user logs into Boss Zhipin and copies all visible cookies as instructed.
2. The user supplies authentication, tracking, identity, ...[truncated 868 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to provide every visible cookie.
• Define and document the minimum required cookie names.
• Validate input against an explicit allowlist and reject unknown entries.
• Store credentials in a protected secret store or narrowly scoped environment variables.
• Never log cookie names together with values or include cookie dictionaries in exceptions.
• Clear in-memory credential state when it is no longer required.
• Document session revocation procedures and advise users to rotate exposed cookies.
• Review whether browser-mediated authentication can replace manual extraction of bearer credentials.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/parser.py:237

Finding

Unredacted Resume Data May Be Disclosed to an Arbitrary LLM Client

Content

View full analysis

Vulnerability Details

File Location: scripts/parser.py:237-255
Vulnerability Type: Uncontrolled transfer of personal data to a caller-supplied service
Risk Level: High

python

prompt = llm_prompt or default_prompt.format(text=text)

try:
    response = self.llm_client.generate(prompt)
    data = json.loads(response)

The resume model and parser process sensitive fields including raw resume text, names, ages, phone numbers, email addresses, employment history, education, and salary information.

Technical Analysis

parse_with_llm embeds the complete resume text into a prompt and passes it to any object supplied as llm_client. The code does not constrain the provider or destination, distinguish local from remote clients, redact direct identifiers, request candidate consent, enforce retention restrictions, or warn the caller before disclosure.

A network transfer is not guaranteed because the supplied client could be local. However, when a remote LLM client is configured, the complete resume can leave the intended recruitment environment. Since the client interface is unrestricted, a malicious or misconfigured client can also retain or forward the prompt.

Attack Path

1. The Skill obtains or receives a candidate's resume text.
2. The caller constructs ResumeParser with a remote, compromised, or incorrectly configured LLM client.
3. parse_with_llm inserts the complete resume into the prompt.
4. self.llm_client.generate(prompt) sends or otherwise exposes that prompt to the configured client.
5. The provider or attacker receives personal identifiers, contact details, salary data, and employment history.
6. The data may then be retained, logged, used for model processing, or disclosed beyond the original recruitment purpose.

Impact Assessment

The affected scope is the complete resume supplied to each invocation. Potentially exposed information includes direct contact details, i ...[truncated 346 chars]

Remediation

View remediation

Remediation Suggestions

• Make local parsing the default and require an explicit opt-in before invoking a remote model.
• Require documented candidate consent and a defined lawful processing purpose.
• Redact phone numbers, email addresses, names, and other unnecessary identifiers before constructing the prompt.
• Send only the minimum fields required for the requested extraction.
• Restrict accepted clients to approved providers with configured endpoints and retention guarantees.
• Add a local-only mode and a policy flag that prohibits network-backed clients.
• Encrypt transport, disable provider-side training and logging where supported, and establish deletion and retention controls.
• Record an auditable disclosure event without logging the resume contents.
• Validate custom prompts so they cannot silently expand the requested disclosure scope.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description claims candidate search, resume retrieval, bulk greeting, and Scrapling-based crawling, but the analyzed implementation apparently does not perform those actions. This mismatch is dangerous because reviewers and users may approve the skill under false assumptions, and future code changes could introduce high-risk automation under an already-approved description.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The step-by-step instructions directly guide a user to open browser developer tools and extract sensitive browser cookies from a logged-in session. This is dangerous because it operationalizes credential harvesting behavior and lowers the barrier to exfiltrating reusable session tokens from a real account.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Telling users to provide all visible cookies, including core auth tokens and device identifiers, expands the blast radius far beyond the minimum necessary and encourages over-collection of highly sensitive session material. Those values can be replayed to impersonate the user, bypass account protections, or aid fingerprint-based anti-abuse evasion.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The environment variable examples normalize storing live authentication cookies in local .env configuration for later automated use. While env vars are sometimes used for secrets, here they are coupled with prior instructions to harvest session cookies manually, making it easy to persist and reuse stolen or overprivileged bearer tokens.

Content

Scanner excerpt · references/config.md (reported line 129)May include surrounding context.

环境变量配置

bash

# .env 文件
BOSSBOT_COOKIE_STOKEN=your_stoken
BOSSBOT_COOKIE_PHOENIX=your_phoenix
BOSSBOT_DAILY_SEARCH_LIMIT=200

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

batch_greet 的文档和命名都表明其会“批量发送招呼”，但实际发送逻辑被注释掉了（L254-L256），代码仅构造文案后直接将结果记为成功（L258-L259）。这不是单纯实现不完整，而是对外宣称已执行招聘触达操作，实际却没有进行对应网络动作，属于明确的意图-代码背离。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises network-capable scraping and account-based platform interaction but does not declare any explicit tool scope or permissions boundary. In an agent environment, missing scope declarations can allow broader-than-expected network use and reduce reviewability of what external actions the skill may perform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill includes batch outbound greetings to candidates but lacks a prominent warning that it automates unsolicited messaging at scale. In a recruitment context, this can enable spam, platform abuse, account suspension, and compliance issues, especially if an agent triggers bulk messaging without granular user review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill describes retrieving resumes and storing them in a talent database without a clear privacy warning or handling guidance for personal data. Candidate resumes commonly contain sensitive personal information, so collecting, parsing, and storing them without explicit privacy disclosures increases the risk of unauthorized retention, misuse, or regulatory noncompliance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file tells users how to extract authentication cookies from browser developer tools and then place them into code/config without clearly warning that these values are sensitive credentials. This creates a high likelihood of credential exposure through source control, logs, screenshots, prompt history, or accidental sharing, enabling account takeover or unauthorized session reuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation explicitly instructs operators to collect and use live authenticated Boss直聘 cookies and device/session identifiers, which are effectively bearer credentials tied to a real account. In the context of a scraping/recruitment automation skill, this enables account-backed access and impersonation rather than simple public-data retrieval, increasing the risk of unauthorized access, account misuse, and policy evasion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill is designed to operate using authenticated cookies against a third-party recruitment platform, but provides no explicit safeguards or warnings around credential handling. In this context, session cookies can grant account-level access to candidate data and messaging actions, so unsafe storage, reuse, or sharing of cookies could enable account compromise or unauthorized activity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code retrieves and structures detailed resume information, including employment history, education, and self-description, which are sensitive personal data. In a recruitment scraping skill, the absence of any consent, authorization, minimization, retention, or user-warning controls increases the risk of privacy violations, overcollection, and misuse of candidate PII.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

L244 的注释说明代码将获取候选人信息用于个性化，但实际调用是 search_candidates(keyword='', page=1)，既未使用当前 candidate_id，也未从返回结果中提取对应候选人。随后格式化招呼语时还使用了硬编码占位值（L249-L252），与注释表达的行为直接不一致。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The LLM-enhanced path sends full resume text, including highly sensitive personal data such as phone numbers, email addresses, age, salary, work history, and education, to an external llm_client without any minimization, consent gate, or disclosure in this file. In a recruitment scraping skill, this materially increases privacy, compliance, and third-party data exposure risk because candidate PII may be transmitted off-platform or retained by another service.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The proxy configuration adds infrastructure for routing requests through third-party endpoints, which can facilitate evasion of rate limits, geographic controls, or anti-abuse defenses. In a skill already designed for automated scraping and bulk outreach, this materially increases the capability for stealthy or scaled misuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

Natural-language strings and documentation in this file consistently require Chinese comprehension, including class docstrings, prompts, and example content. There is no indication that users can opt into another language or that the skill is intentionally restricted to a Chinese-only context.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/parser.py (reported line 269)May include surrounding context.

python

# 合并基础解析和LLM解析
            base_resume = self.parse(text)
            for key, value in data.items():
                if value and getattr(base_resume, key) is None:
                    setattr(base_resume, key, value)
            
            return base_resume

Static analysis

No suspicious patterns detected.