安全决策报告
job-agent
This is a documentation-only skill that instructs the AI to invoke the jobagent CLI, but the undeclared shell:WRITE requirement and remote install pattern present notable concerns despite partial risk acknowledgment.
为什么得出这个结论
2/4 个维度触发 阻止
声明与实际能力
发现 3 项声明之外的能力或越权行为。
阻止
隐藏执行与外联
提取到 1 个高危 IOC 或外联信号。
通过
攻击链与高危发现
没有形成明确的恶意路径。
复核
依赖与供应链卫生
没有完整依赖信息，供应链判断需要保留弹性。
风险分是怎么被拉高的
Undeclared shell execution +10
SKILL.md instructs the AI to run Bash commands (jobagent doctor env, jobagent round start, etc.) but declares no allowed-tools, creating a doc-to-capability mismatch
Remote script download and execution +10
curl|bash installer from GitHub raw URL on line 53; partially acknowledged in skill-card.md but risk remains
No implementation code present +-5
Skill is purely guidance text; no embedded malicious code found in the distributed skill artifact
最关键的证据
中危 文档欺骗
Undeclared shell execution requirements
SKILL.md frontmatter declares allowed-tools: none but the skill body explicitly instructs the AI to run Bash commands (jobagent doctor env, jobagent round start, jobagent <platform> login --check, etc.) across dozens of lines. This is a doc-to-capability mismatch.
SKILL.md:1 Declare allowed-tools: [Bash] or equivalent shell:WRITE if the AI is expected to invoke jobagent CLI commands. The skill effectively requires this capability.
中危 供应链
Remote script download via curl|bash
Line 53 contains 'curl -fsSL https://raw.githubusercontent.com/jiyangnan/AgentMesh-JobAgent/main/scripts/install.sh | bash' — a well-known risky pattern that fetches and executes arbitrary code from a remote URL. The Windows variant uses 'irm ... | iex' with the same risk.
SKILL.md:53 Pin the installer to a specific tagged release with a hash verification step. Prefer pre-installed CLI delivery or require users to clone and inspect the repo manually before execution.
低危 文档欺骗
Missing filesystem:READ declaration for resume file access
SKILL.md references 'jobagent resume analyze --file <resume-path>' which implies reading local resume files, but no filesystem:READ is declared in allowed-tools.
SKILL.md:66 Add filesystem:READ to declared capabilities if the AI will handle resume file paths.
声明能力 vs 实际能力
命令执行 阻止
声明 NONE
→ 推断 WRITE
SKILL.md instructs Bash execution of jobagent CLI commands throughout without declared allowed-tools 文件系统 阻止
声明 NONE
→ 推断 READ
SKILL.md references reading resume files (--file <resume-path>) and output review files without filesystem:READ declaration 技能调用 阻止
声明 NONE
→ 推断 READ
SKILL.md is itself a skill-invoke document, instructing the AI to call the jobagent CLI as a subprocess 可疑产物与外联
严重 危险命令
curl -fsSL https://raw.githubusercontent.com/jiyangnan/AgentMesh-JobAgent/main/scripts/install.sh | bash SKILL.md:53
中危 外部 URL
https://jobagent.agentmesh360.com/ SKILL.md:8
中危 外部 URL
https://agentmesh360.com/app/ SKILL.md:24
中危 外部 URL
https://clawhub.ai/user/jiyangnan skill-card.md:7
中危 外部 URL
https://clawhub.ai/jiyangnan/skills/job-agent skill-card.md:31
依赖与供应链
没有结构化依赖告警。
文件构成
3 个文件 · 191 行
Markdown 2 个文件 · 186 行JSON 1 个文件 · 5 行
需关注文件 · 2
SKILL.md Undeclared shell execution requirements · Remote script download via curl|bash · Missing filesystem:READ declaration for resume file access · curl -fsSL https://raw.githubusercontent.com/jiyangnan/AgentMesh-JobAgent/main/scripts/install.sh | bash · https://jobagent.agentmesh360.com/ · https://agentmesh360.com/app/
skill-card.md https://clawhub.ai/user/jiyangnan · https://clawhub.ai/jiyangnan/skills/job-agent
其他文件 · _meta.json
安全亮点
MIT-0 license with publicly verifiable open-source repository
Risks partially acknowledged in skill-card.md under Known Risks and Mitigations
No embedded code, obfuscation, or base64 payloads found
No credential harvesting, environment variable iteration, or sensitive path access
No C2 communication, reverse shell, or data exfiltration patterns
Skill is purely guidance/documentation; no runtime execution risk from the skill artifact itself