ClawHub
Back to skill

Security audit

ATS Keyword Extractor

Security checks for vulnerabilities and agentic risk

Overview

The keyword tool fits its purpose, but its example automatically sends any existing resume.txt file to an outside service without confirming that the user wants to include it.

Use a dedicated working folder containing only the documents you intend to share. Omit resume.txt unless you want resume comparison, and remove contact details before uploading. Confirm the service's retention practices before sending private documents; its public [repository documentation](https://github.com/a0971025732-netizen/finch-agent-catalog-mcp) does not establish resume-data guarantees. Review is warranted for the automatic file inclusion, not merely for using a remote service.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

The workflow sends job descriptions and optional resume text to an external service without an explicit privacy warning.

Medium
Category
Output Handling
Confidence
91% confidence
Finding

The workflow transmits job descriptions and optional resume contents to an external service without clearly warning the user about that disclosure or requiring approval before sending resume data. Although the endpoint is visible and remote processing is consistent with the skill's purpose, resumes and nonpublic job descriptions can contain sensitive information, and the unsupported assurance that 'nothing is stored' may discourage appropriate caution.

Content

No source excerpt is available for this finding.

The runnable example sends unredacted resume text despite the explicit instruction to remove contact information.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The runnable example reads the entire resume.txt file and includes it in an external request without implementing the stated contact-information removal rule. Resumes commonly contain personal information, so following the example verbatim can disclose phone numbers, email addresses, and home addresses despite the later instruction to remove them.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.