boss-agent-cli-job-search
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The tool manages highly sensitive job seeker credentials and AI provider API keys (e.g., OPENAI_API_KEY, ANTHROPIC_API_KEY, ATLAS_API_KEY). Although the documentation states that credentials are encrypted locally using Fernet and PBKDF2 machine binding, the storage of these secrets in environment variables and local configuration files (~/.boss-agent/config.json) represents a significant data exposure risk if the machine is compromised.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of external components, specifically the
patchrightlibrary and Chromium browser kernels.patchrightis a specialized automation tool often used to bypass bot detection mechanisms, which increases the complexity of the execution environment and introduces third-party dependencies. - [COMMAND_EXECUTION]: The documentation provides examples of integrating the CLI into other applications using
subprocess.run(['boss'] + args). This pattern is vulnerable to command injection if the arguments (such as search queries or city names) are not properly sanitized before being passed to the shell execution environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content by fetching Job Descriptions (JDs) from third-party platforms for AI analysis via
boss ai analyze-jdandboss ai optimize. - Ingestion points: Job descriptions are fetched from BOSS Zhipin, Zhilian, and other platforms through the
searchanddetailcommands. - Boundary markers: The provided documentation does not specify the use of clear delimiters or instructions to ignore embedded commands within the fetched JD content.
- Capability inventory: The skill has capabilities for AI analysis, resume optimization, and local file system writes (~/.boss-agent/).
- Sanitization: There is no mention of sanitization or filtering of the external JD content before it is passed to the AI models for analysis, which could allow malicious instructions hidden in job postings to influence the agent's behavior.
Audit Metadata