Security audit

Liepin Jobs

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Liepin job-search helper, but it can handle account tokens, resumes, and job applications without enough enforced safeguards.

Review before installing. Use only the official Liepin endpoint, avoid the --url option unless you fully trust the destination, protect or remove the saved config file, and manually verify every resume update or job application before allowing the agent to run it. Revoke/regenerate the Liepin token if it may have been saved with weak permissions or sent to an untrusted endpoint.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: liepin_mcp.py:61
Finding: Configurable MCP Endpoint Can Exfiltrate the Liepin User Token
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: liepin_mcp.py:31
Finding: Long-Lived User Token Is Stored Without Explicitly Restrictive File Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: liepin_mcp.py:172
Finding: Irreversible Job Applications Lack Code-Level User Confirmation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'mcp' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list includes broad everyday terms such as 求职, 招聘, 简历, and 搜职位, which can match many ordinary conversations and cause accidental activation. Because this skill can access resumes and submit job applications, unintended invocation could expose personal data or prepare irreversible actions in the wrong context.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill exposes list-tools and a generic call <tool-name> interface, which expands its effective capability beyond the declared job-search and resume-management scope. This creates a scope-bypass risk: if the upstream MCP server exposes additional sensitive or state-changing tools, the agent could enumerate and invoke them without explicit user understanding or manifest-level restriction.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The workflow says to act when the user says broad phrases like '帮我找工作', which is ambiguous and may not clearly indicate consent to use this specific external service. In this skill’s context, ambiguous invocation is more dangerous because the tool can read/edit resume data and lead toward irreversible application submission.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The default prompt broadly instructs the agent to use the skill for searching roles, reviewing resumes, and preparing applications, which increases the chance of implicit or unintended invocation when a user mentions related topics. Because this skill can act on sensitive job-seeking data and potentially submit applications, over-broad activation could trigger privacy-sensitive operations without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Applying to a job is an externally visible account action that may affect the user's professional reputation and trigger notifications to employers. Performing it immediately from CLI input with no explicit confirmation increases the risk of accidental or coerced submissions, especially when used by higher-level agents.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Resume updates modify sensitive profile data on a remote service, but the command sends changes without an explicit warning, preview, or confirmation. This raises the risk of accidental corruption of the user's resume or unauthorized profile changes when invoked by automation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The generic call subcommand allows invocation of arbitrary remote MCP tools, which exceeds the skill's declared scope of job search, applications, and resume management. If the remote server exposes additional sensitive account or data-manipulation tools, this CLI becomes a broad proxy for unintended actions under the user's token.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: Enumerating all remote MCP tools broadens discovery beyond the stated purpose-specific workflow and can reveal unexpected capabilities available under the authenticated session. In combination with the generic call feature, this materially increases the chance of misuse by making hidden or administrative tools easier to find and invoke.
Content: No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Confidence: 50% confidence
Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
Content: Scanner excerpt · liepin_mcp.py (reported line 185)May include surrounding context.
python
arguments = {} for key in ("jobName", "address", "salary", "education", "experience", "companyType", "companyName"): val = getattr(args, key, None) if val: arguments[key] = val