Security audit

ClawCV龙虾简历 - 全网最强大的AI求职Skills套装

Security checks for vulnerabilities and agentic risk

Overview

ClawCV appears to be a real resume helper, but it needs review because it runs an unpinned npm MCP server, sends sensitive resume data to WonderCV, and exposes API keys through setup examples.

Install only if you are comfortable running the current npm clawcv package as local MCP code and sending resume, job-description, education, city, and career-planning data to WonderCV. Prefer a pinned package version, avoid putting the API key directly in shell commands, check local MCP config file permissions, and use explicit phrases like "use ClawCV" so sensitive resume data is not sent by accident.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:273
Finding: Mandatory Promotional Output Injection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:29
Finding: Unpinned npm Package Is Downloaded and Executed
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:29
Finding: API Key Passed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README.md (reported line 71)May include surrounding context.
If you are configuring MCP manually, use the npx setup below. It does not require a global install.

Claude Code (~/.claude/settings.json):

json
{

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README_EN.md (reported line 70)May include surrounding context.
If you are configuring MCP manually, use the npx setup below. It does not require a global install.

Claude Code (~/.claude/settings.json):

json
{

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger conditions are very broad and match common resume-help language, increasing the chance the skill is auto-invoked when a user did not explicitly intend to send resume data to this external service. In the context of a resume-processing skill that transmits personal employment and education data to a backend, unintended activation materially increases privacy and consent risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The example phrases are generic requests that overlap with ordinary resume assistance and could trigger automatic invocation without clear user awareness that a third-party tool is being used. Since resume content commonly contains sensitive PII and career history, ambiguous activation makes accidental disclosure more dangerous than in a low-sensitivity skill.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The README instructs users to run the MCP server via npx clawcv without pinning an exact package version. That allows whatever package version is current at install/run time to execute, creating a supply-chain risk if a malicious or compromised update is published. Because this command is presented as the primary install path for an AI-integrated tool, users may execute it with little scrutiny.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The Claude Code setup example again uses unpinned npx clawcv, which causes the AI tool to fetch and execute the latest package version at runtime or install time. If the npm package is ever hijacked, typo-squatted, or maliciously updated, users could unknowingly grant code execution inside their local AI tooling context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README does not provide a prominent upfront notice, before installation/use, that resume content and related usage/session data are sent to a remote WonderCV backend and that some session data is persisted. This weakens informed consent and can cause users to disclose highly sensitive personal and employment information without understanding the data flow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README prominently advertises resume analysis and related features before clearly disclosing that conversation data and processed resume content are sent to the WonderCV backend. This undermines informed consent and increases the risk that users share sensitive personal and employment information without realizing it leaves the local AI environment.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README encourages automatic invocation from natural phrases like 'analyze my resume,' which are broad enough to collide with ordinary conversation. In an agentic environment, this can cause unintentional transmission of resume contents or related chat context to the backend without a clear user confirmation step.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The install command runs an unpinned package from the npm registry via npx, so users may execute whatever version is current at invocation time. If the package is compromised, typosquatted, or a maintainer publishes a malicious update, the AI tool setup path becomes a supply-chain execution vector on the user's machine.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This command again instructs users to invoke an unpinned npm package through npx during MCP registration. Because MCP tools often receive sensitive user data and local execution privileges, an upstream package swap or malicious update could lead to code execution and data theft in a trusted tool context.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The install instruction uses npx clawcv --api-key YOUR_API_KEY without pinning an exact package version. That causes users to execute whatever version is current on npm at install/run time, creating a supply-chain risk where a malicious update, dependency compromise, or typosquatted package could execute arbitrary code and exfiltrate the provided API key.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The Claude Code example also invokes npx clawcv --api-key YOUR_API_KEY without a pinned version. Because this is an MCP server installation path, an attacker controlling a later published package version or compromised dependency chain could gain code execution in the user's environment and potentially access resume data, tokens, and the supplied API key.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description, headings, instructions, and example utterances are entirely in Chinese, which implies the skill is intended to operate only in that language. The file does not offer multilingual handling, user opt-in, or a documented reason for restricting the interaction locale, which is a natural-language policy concern under the language/locale rule.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest description says to use the skill when the user says phrases like “面试怎么准备”, “职业规划”, or “薪资怎么谈”, and the standalone phrase “职业规划” is broad enough to overlap with ordinary conversation. The file does not provide negative examples or explicit constraints clarifying when the skill should not activate.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The natural-language description and instructions are entirely in Chinese and do not state that the user can choose another language. This can violate a language/locale policy if the skill implicitly forces one language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill content, examples, and invocation phrases are entirely in Chinese, and there is no indication that users may interact in another language or opt into this locale. Under the policy rule for natural-language constraints, this can be a language/locale policy violation unless the restriction is explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill description uses broad trigger phrases such as exporting PDF, generating a one-page resume, and final resume requests in a domain where nearby skills also operate on general resume interactions. This can cause the agent to invoke this skill in normal resume conversations before the resume is finalized, leading to inappropriate routing, premature export guidance, or unnecessary account/upgrade prompts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill declares broad trigger phrases such as “分析简历”“看看我的简历”“简历诊断,” which are common user utterances and may cause the skill to activate in situations where the user did not explicitly intend to invoke this workflow. Unintended invocation can route user content into the wrong processing path, leading to confusing behavior, privacy over-collection of resume data, or bypass of a more appropriate skill with narrower scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill content is written to operate in Chinese and its output guidance implicitly assumes Chinese responses, but there is no documented user opt-in, locale detection, or fallback behavior. If invoked for users who are not expecting Chinese, this can degrade comprehension and produce misleading or unusable resume guidance, especially in multilingual or mixed-locale contexts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown skill file presents its description, workflow, and example usage exclusively in Chinese, which can implicitly force a specific language/locale on users. The policy allows locale constraints only when users are given a choice or when the restriction is clearly justified, neither of which is stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The instruction says "始终使用与用户相同的语言回复（默认中文）", which sets a default language policy rather than explicitly asking the user for their preference. This can be a language/locale policy violation when the user's preferred language is not known and no opt-in is obtained.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.