Security audit

Resume Generator Clean

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local resume generator, but its HTML-to-PDF path can give crafted resume HTML under-disclosed access to local files or network resources during rendering.

Install only in an isolated environment, avoid converting HTML from untrusted sources, and do not return generated PDFs to someone who supplied the HTML unless the renderer is sandboxed and local/network resource loading is blocked. Pin and review dependencies before production use, and choose output paths carefully because files may be created or overwritten.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/resume_to_pdf.py:44
Finding: Untrusted HTML Rendering Permits Local File and Network Resource Access
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Dependencies Are Not Reproducibly Pinned or Integrity-Verified
Content: View full analysis
=3.6.0 PyYAML>=5.4.0 python-docx>=0.8.11 beautifulsoup4>=4.9.0 lxml>=4.6.0 ``` ### Technical Analysis Every required package uses an open-ended minimum-version constraint. A future installation can therefore resolve to package versions that were not present when the Skill was reviewed. No lock file or artifact hashes are included to verify the exact distributions installed. This configuration does not itself prove that any listed package is malicious. It creates a supply-chain and reproducibility weakness because installation behavior can change over time or across package indexes without a corresponding change to the reviewed project. The risk is amplified because imported Python packages execute code within the converter process and installation may run package build logic when a compatible wheel is unavailable. ### Attack Path 1. A user follows the documented installation process and installs `requirements.txt`. 2. The package installer queries its configured package index and selects the newest release satisfying each lower bound. 3. The selected artifacts may differ from those originally tested or reviewed. 4. If an upstream release, package-index account, configured mirror, or resolved artifact is compromised, malicious package or build code can execute during installation or later import. 5. That code receives the privileges of the user performing installation or running the Skill. ### Impact Assessment A compromised dependency could potentially access all files, environment variables, credentials, and network resources available to the installer or runtime process. It could also alter generated documents or execute arbitrary code under that account. This finding concerns dependency integrity and reproducibility. The audit did not identi ...[truncated 134 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied code chunk is clearly a resume-generation CLI, so its general purpose aligns with the description at a high level. However, the description materially overstates the implemented capabilities shown here. The code accepts a YAML config file, generates PDF output, supports only two named themes, and includes optional Chinese font handling plus a Chinese example resume. There is no evidence in this chunk of Word export, HTML export, Markdown or HTML input parsing, or broader template/auto-layout functionality. Because several prominent advertised features are not represented by the actual behavior in the provided code, this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code's primary purpose is still resume generation, so it is related to the description. However, the declared description materially overstates capabilities. The supplied code only generates PDFs, not Word or HTML. It accepts YAML configuration input, not Markdown or HTML input. It includes two hardcoded themes, which is narrower than a general multi-template resume generator. Layout is manually assembled with fixed ReportLab tables/spacers rather than an explicit auto-layout engine. Chinese support is implemented via font detection/registration, but explicit bilingual Chinese/English functionality is not demonstrated. Therefore the description does not accurately represent the actual implemented behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a broader multi-format resume generator supporting PDF, Word, and HTML export, bilingual Chinese/English capability, auto-layout, and multiple templates. This code chunk primarily implements Word document generation from HTML or Markdown, plus a fallback HTML file intended only as an intermediate for Word import when python-docx is unavailable. There is no PDF generation, no clear bilingual handling logic, and no substantial auto-layout system. While Markdown/HTML input and some template selection are present, the implemented behavior is materially narrower than the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description overstates the skill's capabilities. The supplied code only implements resume-to-PDF conversion, primarily from HTML content, with three simple CSS templates and a fallback print-ready HTML output if PDF libraries are unavailable. It does not generate resumes from structured data, does not export Word documents, does not provide a true HTML export workflow, and does not implement meaningful bilingual or auto-layout features. While it loosely aligns with part of the description (PDF export and some templates), the primary purpose and feature set are materially narrower than declared.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 198)May include surrounding context.
Linux:

bash
sudo apt-get install fonts-wqy-microhei

Windows:

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill documentation describes capabilities that inherently read inputs and write outputs, but it does not declare any explicit tool scope such as permissions or allowed-tools. In agent environments, missing scope declarations can cause overbroad default access or prevent reviewers from understanding the file-system reach of the skill, increasing the chance of unintended file access or overwrite behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The docstring states this function converts a Markdown resume to a Word document, but the implementation returns generate_docx_from_html(...), a function that does not exist anywhere in the file. In practice, this path will fail rather than perform the documented conversion, creating a direct contradiction between the documented intent and actual behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The description emphasizes 'full Chinese character support' and the examples and troubleshooting sections are centered on Chinese content and fonts, but the README does not clarify whether the skill is intended only for Chinese resumes or whether other languages are equally supported. Under the policy rule, language/locale constraints should either be optional for the user or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file provides multiple commands and API examples that save PDF and DOCX outputs to user-specified paths, which affects local filesystem data. Although the write behavior is implicit in terms like 'output.pdf' and 'save', there is no explicit warning about file creation or overwriting existing files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This YAML example is entirely presented in Chinese, including headings and section labels, with no indication that language is configurable or that the file is intended only for a China-specific or Chinese-language context. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The user-facing description explicitly advertises 'Chinese support', and the built-in example content is entirely in Chinese, which suggests a language/locale bias in the skill experience. Because the file does not present any user choice or opt-in for language/locale, this may conflict with policies against forcing a specific language without user selection.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The dependency is specified with a lower bound only, so installs can vary over time and may resolve to vulnerable or incompatible releases. In a resume generator that renders rich document content, reportlab is security-relevant because past vulnerabilities included code execution and SSRF in document parsing/rendering paths.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
reportlab>=3.6.0 PyYAML>=5.4.0 python-docx>=0.8.11 beautifulsoup4>=4.9.0

Unverifiable Dependency: reportlab has 8 known advisory(ies) (CVE-2023-33733 (Reportlab vulnerable to remote code execution); CVE-2020-28463 (Server-side Request Forgery (SSRF) via img tags in reportlab); CVE-2019-19450 (ReportLab vulnerable to remote code execution via paraparser) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: reportlab has multiple known advisories, including past RCE and SSRF issues, and the manifest does not pin a version, so there is no way to determine whether installations are affected. In a resume generator that converts user-supplied content to PDF, this context increases risk because the vulnerable functionality may be exercised during rendering.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: PyYAML is unpinned, which makes builds non-reproducible and prevents verification that deployed versions are outside known vulnerable ranges. This skill advertises Markdown/HTML input and document generation, so any YAML-based configuration or template loading would make unsafe version drift more concerning.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
reportlab>=3.6.0 PyYAML>=5.4.0 python-docx>=0.8.11 beautifulsoup4>=4.9.0 lxml>=4.6.0

Unverifiable Dependency: PyYAML has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: PyYAML has multiple historical deserialization and input-validation issues, and without a pinned version the deployed package may fall within vulnerable ranges. If the skill uses YAML for resume data, templates, or configuration, malicious input could exploit unsafe parsing paths more easily.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: python-docx is declared with only a minimum version, so environments may pull different releases and security posture cannot be verified. Since this skill exports Word documents, XML parsing and document generation libraries are directly exposed to potentially attacker-controlled resume content.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
reportlab>=3.6.0 PyYAML>=5.4.0 python-docx>=0.8.11 beautifulsoup4>=4.9.0 lxml>=4.6.0

Unverifiable Dependency: python-docx has 2 known advisory(ies) (CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 86% confidence
Finding: python-docx has known XXE-related advisories, and the lack of version pinning prevents validation that the installed release includes the relevant fixes. Given this skill exports Word documents, the library is directly relevant, though the cited issue is older and the minimum version may already exceed vulnerable releases.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: beautifulsoup4 is unpinned, which weakens supply-chain control and reproducibility even if no specific advisory is cited here. In a tool that accepts HTML/Markdown input, parser behavior matters for sanitization and transformation, so uncontrolled version changes can introduce security regressions.
Content: Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.
text
reportlab>=3.6.0 PyYAML>=5.4.0 python-docx>=0.8.11 beautifulsoup4>=4.9.0 lxml>=4.6.0 # Optional: For better HTML to PDF quality

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: lxml is unpinned despite being a high-risk parser library with a long history of security issues. Because the skill processes HTML and likely XML-backed document formats, parser vulnerabilities could become reachable through crafted resume input or imported templates.
Content: Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.
text
PyYAML>=5.4.0 python-docx>=0.8.11 beautifulsoup4>=4.9.0 lxml>=4.6.0 # Optional: For better HTML to PDF quality # weasyprint>=53.0

Unverifiable Dependency: lxml has 14 known advisory(ies) (CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +11 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 91% confidence
Finding: lxml has numerous security advisories, and the absence of version pinning makes it impossible to verify whether users install a vulnerable build. In a resume generator that accepts HTML input and may transform document structures, parser and cleaner vulnerabilities are especially relevant because crafted content could trigger them.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This code reads arbitrary resume input content from disk and later writes it into a generated DOCX or HTML output, which commonly contains personal identifiers, contact details, and employment history. Although file conversion is the script's purpose, there is no explicit warning or comment disclosing that sensitive resume data will be copied into new local output files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The script writes generated output to the user-supplied path and also creates a fallback HTML file later, but there is no confirmation prompt or explicit warning that existing files at those paths may be overwritten. The docstrings describe the output argument, yet they do not disclose the overwrite/file-creation side effect in a user-facing safety warning.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: When PDF generation fails, the script silently switches behavior and writes a separate _print.html file derived from the requested PDF path. Although it prints a notice afterward, there is no prior disclosure in the main usage/help text or function contract that an extra file may be created.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.