job-hunt

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt explicitly requires handling login states (browser MCP, cookies import, reading user platform groups) and may ask users to provide cookies/login credentials for real-time scraping, so the LLM would receive and use sensitive session tokens (high exfiltration risk) even though it warns not to persist them.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.78). 该 Skill 在运行时会对用户选择的平台执行 WebSearch/网页抓取（如 site:... 搜索并读取搜索引擎摘要、以及质检时对岗位详情链接进行 WebFetch），这些页面/岗位 JD 文本属于外部作者发布的招聘内容，可能包含间接提示注入文本进入 LLM 上下文。

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)