T09 · Insecure Skill Coding Practices
- Location
SKILL.md:13- Finding
Unprotected Disclosure of Resume Data to a Third-Party Service
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 13-28 and 153-160
Vulnerability Type: Uncontrolled transmission of sensitive personal data to an external service
Risk Level: HighVulnerable Code
bash curl -X POST "https://openapi.51mee.com/api/v1/parse/match" \ -F "file=@候选人简历.pdf" \ -F "jd_text=岗位职责:\n1. 负责系统架构设计\n\n任职要求:\n- 5年以上Java开发经验\n- 熟悉Spring Boot"The batch-processing workflow also directs the agent to invoke the external matching interface for every candidate:
markdown 1. **定义岗位要求** - 收集完整的职位描述 2. **逐个匹配** - 对每个候选人调用匹配接口 3. **对比排序** - 按 `overall_score` 排序 4. **输出报告** - 生成排名对比表Technical Analysis
The skill directs the agent to upload complete resume files and job descriptions to
https://openapi.51mee.com/api/v1/parse/match. Resumes commonly contain sensitive personal information, including names, telephone numbers, email addresses, home addresses, employment histories, education records, salary expectations, and other identifying information.Although the endpoint uses HTTPS, transport encryption alone does not provide adequate privacy controls. The skill does not require:
- Explicit user confirmation before transmitting a resume.
- Confirmation that the candidate authorized third-party processing.
- Disclosure of the external recipient before upload.
- Redaction or minimization of unnecessary personal information.
- Review of the provider's retention, deletion, jurisdiction, and secondary-use policies.
- Restrictions against logging resume contents or API responses.
- An approved or configurable enterprise endpoint.
The batch-processing workflow increases the scope because it instructs the agent to upload every candidate's resume individually. This can turn a single unconfirmed disclosure into a bulk personal-data exposure.
Attack Path
- A user provides one or more candidate resumes for job matching.
- The agent follows the ski ...[truncated 1505 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed confirmation immediately before each external upload. The confirmation should identify the destination domain and the categories of data being transmitted.
- Require the user to confirm that each candidate has authorized resume processing by the external provider.
- Apply data minimization before transmission. Remove contact details, addresses, identification numbers, photographs, and unrelated personal information unless strictly necessary.
- Prefer extracting only job-relevant attributes locally and transmitting those attributes instead of the complete source document.
- Document and validate the provider's privacy policy, data-retention period, deletion mechanism, processing jurisdiction, access controls, subprocessors, and restrictions on secondary use.
- Make the endpoint configurable and restrict it to an organizational allowlist of approved services.
- Provide a local-processing option for resumes that cannot be shared externally.
- Prohibit logging of uploaded files, multipart request bodies, sensitive response fields, and candidate identifiers.
- Add explicit batch-processing safeguards, including a preview of affected candidates, a single informed approval covering the stated batch, per-file minimization, and an abort mechanism.
- Define a deletion procedure through which submitted data and derived results can be removed from the provider after processing.