ClawHub
Back to skill

Security audit

Resume Builder

Security checks across malware telemetry and agentic risk

Overview

This is a resume-building helper that asks for resume details and outputs Reactive Resume JSON, with no evidence of hidden execution or data misuse.

Install only if you are comfortable using an AI assistant to format resume data. Share only details you want included in the final resume JSON, and consider omitting or using placeholders for phone numbers, exact locations, reference contact details, or private links until you are ready to export or import the resume.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
83% confidence
Finding
The skill description uses very broad trigger language such as creating, building, generating, or discussing resume structure/content, which can cause the skill to activate in ordinary resume-related conversations without clear user intent to invoke it. Over-broad activation increases the chance of unnecessary context capture, inappropriate steering, or accidental collection of personal data before the user explicitly wants structured resume generation.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The workflow explicitly instructs the agent to collect sensitive personal information including full name, email address, phone number, and location, but it does not warn the user about privacy implications, retention, or that the resulting JSON may be imported into a third-party resume service. Because resumes often contain highly identifying data, silent collection and downstream formatting/sharing increases privacy and misuse risk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.