Resume JD Match — JD定制简历

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:35 AM UTC
• Version: 2.0.0

Overview

This resume skill is useful and mostly purpose-aligned, but it stores sensitive personal profile data in a plaintext workspace file and its security description understates where it writes data.

Review before installing if you are comfortable storing resume details, contact information, and possibly birth date in a plaintext workspace file. Use it only in a private workspace, avoid committing generated profile or resume files, and inspect generated HTML before opening or sharing it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:23
• Finding: Plaintext Persistence of Sensitive Resume Profile Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 23-35 **Vulnerability Type**: Plaintext storage of sensitive personal information **Risk Level**: Medium ### Vulnerable Code ```markdown ## Phase 1: Profile Collection On first run (no `resume-profile.md` exists), collect user info. Ask one section at a time, confirm before next. Save to `resume-profile.md`. **Confirm preferences first:** 1. **Accent color** — hex/name, default `#6b4c9a` 2. **Language** — 中文 or English 3. **Target region** — mainland China (include birth date) or overseas (exclude) ### Sections (structured data per section) 1. Personal — name, phone, email, birth date, location, LinkedIn 2. Education — school, degree, major, date, honors 3. Work Experience — per role: company, title, dates, 3-6 bullets (quantify!) 4. Side Projects — per project: name, type, status, role, features/metrics, tech stack 5. Skills — domain + technical tools + languages, grouped 6. Certificates & Awards ``` ### Technical Analysis The workflow explicitly collects phone numbers, email addresses, birth dates, locations, employment histories, and education records, and then persists them in a plaintext Markdown file named `resume-profile.md`. The instructions do not establish: - Explicit consent for persistent storage - Restrictive file permissions - Encryption at rest - A retention or automatic deletion policy - A user-facing deletion mechanism - Protection against accidental source-control commits - Data minimization for fields such as birth date This is an insecure storage practice because the profile remains readable to any process or user that can access the workspace. The exposure lasts beyond the immediate resume-generation operation. ### Attack Path 1. A user invokes the Skill and supplies personal and professional information. 2. The Agent writes the information to `resume-profile.md` as instructed. 3. The plaintext profile remains in the workspace after the session finishes. 4. ...[truncated 948 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Obtain explicit user consent before persisting any profile information. 2. Make persistent storage optional and default to session-only processing. 3. Collect birth dates only when demonstrably required and explicitly approved by the user. 4. Store the profile in a user-approved private directory rather than an implicitly shared workspace. 5. Create the file with permissions restricted to the current user. 6. Encrypt sensitive profile data at rest when persistent reuse is enabled. 7. Define a clear retention period and provide commands to inspect, export, update, and permanently delete the profile. 8. Add `resume-profile.md` and generated resumes to `.gitignore` and equivalent synchronization exclusions. 9. Warn users before storing data in directories managed by source control, cloud synchronization, or shared development environments. 10. Document which fields are stored, why they are needed, and how long they remain available. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:38
• Finding: Untrusted Resume and Job Description Fields May Be Embedded into HTML Without Escaping<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 38-59; supporting template in `references/html-template-guide.md`, lines 5-25 **Vulnerability Type**: HTML injection caused by missing output-encoding requirements **Risk Level**: Medium ### Vulnerable Code From `SKILL.md`: ```markdown ## Phase 2: JD Match & Generate ### 2.1 Collect JD Accept pasted text, file, or URL. Parse and confirm with user before proceeding: - Job title, company, core requirements (3-5), preferred qualifications ### 2.2 Match Analysis (show user, wait for confirmation) ``` 🎯 Target: [Title] @ [Company] 📊 Match: [High/Medium/Low] ✅ Strong matches: ... ⚠️ Gaps: ... 📝 Strategy: Emphasize / Reframe / Downplay ``` ### 2.3 Generate HTML Resume Single self-contained HTML with inline CSS. See [references/html-template-guide.md](references/html-template-guide.md). **Content rules:** - 3 core advantages in top highlight grid → mapped to top JD priorities - Work experience ordered by JD relevance - Mirror JD keywords naturally, don't stuff - Every bullet quantified where possible - Skills section prioritizes JD-required skills (use tag-highlight class) - 1-2 pages A4 max ``` From `references/html-template-guide.md`: ```html <!DOCTYPE html> <html lang="zh-CN"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>[Name] - [Job Title]</title> <style>/* see CSS below */</style> </head> <body> <div class="resume"> <div class="header"> <!-- Name, target, contact --> <div class="section edu"> <!-- Education (brief, near top) --> <div class="section"> <!-- 3 Core Advantages grid --> <div class="section"> <!-- Key Projects --> <div class="section"> <!-- Work Experience --> <div class="section"> <!-- Core Competencies grid --> <div class="section"> <!-- Skills tags --> <div class="section"> <!-- AI Too ...[truncated 2857 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require context-aware HTML escaping for every dynamic field, including names, contact details, job titles, company names, project descriptions, skills, and JD-derived text. 2. Use a templating engine with automatic escaping instead of constructing HTML through direct string interpolation. 3. Treat all profile, file, pasted-text, and URL-derived content as untrusted. 4. If limited formatting is required, sanitize it with a strict allowlist that excludes scripts, event-handler attributes, forms, frames, embedded objects, and remote-resource elements. 5. Validate links and permit only explicitly approved `https:` URLs. Reject `javascript:`, `data:`, `file:`, and other unsafe or unnecessary schemes. 6. Ensure user-provided strings cannot be inserted into `<style>`, raw CSS, script, or attribute contexts. 7. Validate accent-color input against a strict grammar, such as six-digit hexadecimal color values, rather than accepting arbitrary CSS. 8. Add a Content Security Policy that blocks scripts, plugins, frames, and remote resources. For a self-contained resume, use a policy such as `default-src 'none'; style-src 'unsafe-inline'; img-src data:`. 9. Configure the PDF renderer with network access disabled and local-file access restricted to the generated document and explicitly required assets. 10. Add tests using payloads containing closing tags, event handlers, malicious links, remote images, and CSS injection to verify that they appear only as inert text. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Hidden Instructions

High

• Category: Prompt Injection

Content

</head>
<body>
    <div class="resume">
        <div class="header">       <!-- Name, target, contact -->
        <div class="section edu">  <!-- Education (brief, near top) -->
        <div class="section">      <!-- 3 Core Advantages grid -->
        <div class="section">      <!-- Key Projects -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The 'Use when' section includes broad phrases like 'make me a resume' and 'customize resume for this job', which can overlap with common user requests and may cause unintended invocation. The description does not provide explicit exclusion conditions or narrower trigger boundaries to distinguish when this skill should or should not activate.

Static analysis

No suspicious patterns detected.