Head Hunter

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:47 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed recruiting assistant with no hidden persistence or exfiltration behavior, though users should treat hiring recommendations and candidate data carefully.

Install in a virtual environment and consider pinning email-validator before use. Because the skill handles candidate profiles and may influence hiring outcomes, avoid providing unnecessary personal data and treat its rankings as decision support rather than an automatic hiring decision.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:7 and README.md:4,38
Vulnerability Type: Unpinned dependency and mutable supply-chain installation
Risk Level: Medium

Vulnerable Code

SKILL.md:7:

yaml

metadata: {"clawdbot":{"emoji":"🎯","tags":["recruitment","hiring","candidate-matching","headhunter","hr","jobs","ai-hiring","talent-acquisition"],"requires":{"bins":["python3"],"env":[],"config":[]},"install":["pip install email-validator"],"os":["darwin","linux","win32"]}}

README.md:4:

markdown

> **快速开始：** `pip install email-validator && python3 test_headhunter.py`

README.md:36-38:

bash

# 安装基础依赖
pip install email-validator

Technical Analysis

The installation instructions request email-validator without specifying an exact version, integrity hash, lock file, or explicitly trusted package source. Consequently, the artifact installed by pip can change over time even though the reviewed Skill remains unchanged.

This creates a mutable supply-chain boundary: installation relies on the package index, the selected package release, its transitive dependencies, and any build or installation logic supplied by those packages. If a future release or dependency is compromised, users can receive and execute content that was not part of this audit.

The reviewed project contains only README.md and SKILL.md; it does not vendor or otherwise provide the dependency for inspection. The audit found no evidence that the named package is currently malicious. The risk arises from installing an unpinned and unhashed external dependency.

Attack Path

1. A user installs or activates the Skill and follows its dependency-installation instruction.
2. pip install email-validator queries the configured Python package index and resolves the package version available at that time.
3. An attacker compromises a future package release, a transitive dependency, the package-publi ...[truncated 997 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an explicitly reviewed version, for example:

   bash

   python3 -m pip install "email-validator==REVIEWED_VERSION"
   

2. Generate and publish a lock or requirements file containing cryptographic hashes, then enforce hash verification:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Pin and hash all transitive dependencies rather than only the direct package.

4. Document the approved package index and use an explicitly configured trusted source, preferably an organization-controlled package mirror.

5. Run installation in an isolated virtual environment as an unprivileged user; do not recommend administrative or system-wide installation.

6. Add dependency vulnerability and provenance checks to the release process, and review updates before changing pinned versions.

7. Keep the installation metadata and README instructions synchronized so every installation path applies the same version and integrity controls.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The README is predominantly written in Chinese, including setup, usage, roadmap, and status sections, while not indicating that the skill supports multiple languages or that Chinese is a required locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance is broad and uses common recruitment-related phrasing such as 'recruitment advice' and 'hiring decisions,' which can cause the system to invoke this skill in contexts that only loosely relate to candidate matching. Over-triggering is dangerous because it can inappropriately steer general conversations into hiring workflows, increasing the chance of irrelevant guidance, mishandling sensitive candidate data, or applying recruitment framing where it was not intended.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.