T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:682- Finding
Automatic Processing and Storage of Sensitive Candidate Data Without Adequate Safeguards
- Content
View full analysis
- Remediation
View remediation
Security audit
招聘全流程助手
Security checks for vulnerabilities and agentic risk
Overview
The skill is a recruiting assistant with no hidden code, but it under-scopes high-impact candidate data storage, outbound messaging, onboarding document handling, and credential guidance.
Review before installing. Use this only with restricted Feishu workspaces and require manual approval before writing candidate records, sending messages or calendar invites, running background-check workflows, or storing onboarding documents. Do not rely on its assurance that only you can access Feishu data, and do not follow the password-sharing checklist language.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (20)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill’s fairness section prohibits discriminatory hiring practices, but its automated scoring system explicitly assigns weight to school pedigree and employer background. In a recruiting context, that creates a real risk of systematic proxy discrimination and inconsistent compliance behavior, especially if users rely on the score as a gatekeeping signal for candidate selection.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document says to '告知' account passwords to new hires, which normalizes direct credential sharing instead of secure account activation. Shared or pre-disclosed passwords undermine identity assurance, prevent non-repudiation, and increase risk of interception, reuse, insider abuse, or compromise of corporate systems during onboarding.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill includes background checks, non-compete handling, and onboarding workflows, all of which involve highly sensitive personal and employment data, yet the description lacks explicit safeguards for processing that data across integrated systems. Even though the README mentions written authorization for background checks and limited resume access elsewhere, it does not operationalize controls for data minimization, access restriction, storage, sharing, and cross-tool handling where the risk is highest.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill advertises automated notifications and outreach through Feishu IM and related tools, but it does not clearly warn users about privacy, consent, message content review, or limits on transmitting candidate information. In a recruiting context, this can lead to accidental disclosure of personal data to unintended recipients or inappropriate automated communications containing sensitive details.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The activation cues are very broad recruiting-related phrases such as general discussion of hiring, JD optimization, interview scheduling, and pipeline management. Without scope constraints or confirmation gates, the skill could activate during ordinary conversation and prompt handling of candidate data or operational actions in contexts where the user did not intend to invoke recruiting automation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The description states that the skill is deeply specialized in the China talent market, which conveys a strong locale constraint. Under the policy, locale-specific behavior should either offer user choice or clearly document that the skill is intended only for a justified region-specific use case; this file does not explicitly do so.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill describes extracting resume data and automatically writing candidate records into a talent database without a clear consent notice, minimization rule, or retention boundary. Because resumes contain personal data, silent persistence increases the risk of unauthorized collection, over-retention, and downstream exposure of sensitive candidate information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill includes automated outreach and calendar scheduling flows that can contact external candidates on the user’s behalf, but it does not require explicit confirmation at send time or warn about external communications. In a recruiting workflow, unintended messages or invitations could disclose hiring activity, damage employer reputation, or contact the wrong recipient with personal details.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The checklist directs HR to collect highly sensitive personal data including ID cards, bank details, household registration pages, health reports, and employment records, but provides no instructions for lawful basis, minimization, retention, access control, or secure storage. In an onboarding context this is realistic operational guidance, so omission of privacy and handling safeguards can lead to over-collection, internal misuse, or data leakage.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The entire skill documentation, field labels, outputs, and examples are written only in Chinese, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking or China-specific context. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README documents automated extraction of resume content, scoring, and writing candidate data into Feishu tables, but it does not include any privacy, consent, retention, access-control, or sensitive-data handling requirements. Because resumes contain personal data and often sensitive employment history, an implementer could operationalize this workflow in a way that causes unauthorized collection, over-sharing, or persistent storage of candidate information, creating real privacy and compliance risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The entire README is written only in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or China-specific audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This section explicitly recommends building internal employee tag libraries, scoring candidates against education/company/background tags, and identifying employees with 'good connections' who are willing to share company information, but it provides no privacy, consent, legal, or data-minimization guardrails. In a recruiting skill, this creates a realistic risk of unlawful profiling, overcollection of employee/candidate data, and misuse of personal or confidential information during sourcing and referral activities.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation says the skill will create calendar events, invite interviewers and candidates, and send interview instructions, but it does not mention any approval, preview, or confirmation step before acting on the user's behalf. In a recruiting context, outbound messages and calendar invites can expose candidate identities, schedules, and internal interviewer information to unintended recipients or send inaccurate communications at scale.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill claims it can create recruiting dashboards and tables containing HC status, channel performance, and candidate pipeline data without warning that this information may include sensitive personal or workforce data. In hiring workflows, even seemingly operational tables can reveal candidate progress, staffing gaps, compensation-related metrics, or other restricted business information if created or shared too broadly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Background-check support is presented as a normal feature without any notice about consent, legal basis, data minimization, or handling of sensitive personal information. Because background checks routinely involve highly sensitive personal data and third-party disclosure, omitting these safeguards can lead to privacy violations, unlawful processing, or inappropriate collection and sharing of candidate information.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The statement that 'only you have permission to access' stored data is an overbroad and likely inaccurate security guarantee for a collaboration platform with role-based sharing and admin controls. Such claims can mislead users into overtrusting the tool and entering sensitive recruiting data under false assumptions about confidentiality and access boundaries.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file contains user-facing instructions and content exclusively in Chinese, which can be interpreted as forcing a specific language without user opt-in. The policy allows locale constraints when they are explicitly documented and justified, but no such justification or alternative language option appears in the file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
该文档标题及全文均以中文固定呈现，且没有说明这是仅面向中文用户/中国区招聘场景的限定材料，也没有提供其他语言选项。根据语言/区域政策，若技能内容默认强制单一语言而无用户选择或明确正当性说明，可构成自然语言层面的策略问题。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The file forces a single language presentation throughout the skill content without any opt-in, alternative locale, or documented justification for a Chinese-only audience. Under the stated policy, a fixed language without user choice can be a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.