One Page CV

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:28 AM UTC
• Version: 1.0.0

Overview

This resume-generation skill is mostly coherent, but it asks agents to scan local resume-like files and may guide users into privileged or persistent system changes for LaTeX and font setup.

Install only if you are comfortable with a resume tool listing local resume-like files and, if you approve setup prompts, changing your TeX or font environment. Prefer providing the exact resume file and job description yourself, decline automatic dependency/font installation unless you have reviewed the commands, and verify any generated metrics before using the resume.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/latex-template.md:48

Finding

Unpinned and Unverified Third-Party Font Archive Installation

Content

View full analysis

Vulnerability Details

File Location: references/latex-template.md, lines 48-52
Vulnerability Type: Supply-chain risk from an unpinned and unverified external dependency
Risk Level: Medium

bash

curl -L -o /tmp/MapleMono.zip "https://github.com/subframe7536/maple-font/releases/latest/download/MapleMono.zip"
mkdir -p ~/.local/share/fonts
unzip -o /tmp/MapleMono.zip -d ~/.local/share/fonts/MapleMono
fc-cache -fv
rm /tmp/MapleMono.zip

Technical Analysis

The installation procedure downloads a mutable latest release archive from a third-party personal GitHub repository. It does not pin a reviewed version or verify a cryptographic checksum or signature before installing the archive's contents.

Although the downloaded archive is not directly executed as a program, its externally controlled contents are extracted into the user's persistent font directory and subsequently processed by fc-cache and font-handling components. The -o option also permits existing files in the destination to be overwritten without prompting. No validation restricts extracted content to expected font formats or checks archive paths before extraction.

The behavior is not necessary for the Skill's core resume-generation functionality. The project already specifies DejaVu Sans Mono as a Linux fallback, so generating and compiling a resume does not require retrieving this dependency.

Attack Path

1. An attacker compromises the upstream repository, maintainer account, release process, or downloadable release asset.
2. The attacker replaces the asset addressed by the mutable latest/download/MapleMono.zip URL with a malicious or malformed archive.
3. A user grants the installation permission requested by the Skill.
4. The Skill downloads the changed archive without checking a pinned version, checksum, or signature.
5. The archive's contents are extracted into ~/.local/share/fonts/MapleMono, overwriting matching fil ...[truncated 1106 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer the already documented OS-provided fallback font and remove automatic third-party font installation from the normal workflow.
2. If Maple Mono installation remains available, pin an explicitly reviewed release version and immutable asset URL instead of following latest.
3. Publish and verify an expected SHA-256 digest before extraction. Abort installation if verification fails.
4. Where upstream signing is available, verify the release signature against a pinned, trusted maintainer key.
5. Download into a private temporary directory created with mktemp -d rather than using a predictable shared /tmp/MapleMono.zip path.
6. List and inspect archive entries before extraction. Reject absolute paths, parent-directory traversal components, symbolic links, and unexpected file types.
7. Extract into an isolated temporary directory first, then copy only expected .ttf or .otf files into the destination.
8. Avoid unconditional overwrite behavior. Remove unzip -o or explicitly verify destination files before replacing them.
9. Retain the requirement for informed user approval and clearly identify the third-party source, pinned version, expected digest, and files that will be installed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (13)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The activation criteria are extremely broad, triggering on generic career-related terms, pasted job postings, or merely the presence of resume files in the working directory. This can cause the skill to auto-activate in contexts where the user did not ask for resume generation, which in turn increases the chance of unauthorized file discovery, data processing, and unwanted side effects.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

4. Move the output PDF to the working directory root
5. Clean up ALL intermediate files:

bash

rm -f .tex/*.aux .tex/*.log .tex/*.out .tex/*.toc .tex/*.fls .tex/*.fdb_latexmk .tex/*.synctex.gz

If the compile produces 2 pages, you need to fit it on 1 page. Strategies (in order of preference):

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/latex-template.md (reported line 52)May include surrounding context.

mkdir -p ~/.local/share/fonts unzip -o /tmp/MapleMono.zip -d ~/.local/share/fonts/MapleMono fc-cache -fv rm /tmp/MapleMono.zip

text

**Windows** (manual):

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly encourages reframing real experience to make the candidate appear ideally suited for a role and later instructs the agent to invent 'reasonable professional estimates' for missing metrics. That creates deceptive content and can lead the model to fabricate qualifications or outcomes, exposing the user to reputational, ethical, and potentially legal harm.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to check for and offer installation of XeLaTeX and fonts using package-manager and OS-level commands, which expands behavior beyond resume generation into system modification guidance. Even with a permission check, this creates unnecessary risk because the skill can steer users toward executing privileged or environment-altering commands unrelated to the core task.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill includes privileged installation commands using sudo to modify the system package set. Suggesting root-level commands inside a resume-writing workflow is unnecessary and raises the risk of users executing high-privilege changes they do not fully understand.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

If not found, detect the OS and offer to install:
- **macOS**: `brew install --cask mactex-no-gui` (smaller) or `brew install --cask mactex`
- **Linux (Debian/Ubuntu)**: `sudo apt-get install texlive-xetex texlive-fonts-recommended texlive-latex-extra`
- **Linux (Fedora)**: `sudo dnf install texlive-xetex texlive-collection-fontsrecommended`
- **Windows**: Download and install MiKTeX from miktex.org

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

This line continues the recommendation of sudo-enabled package installation, extending privileged execution guidance into another platform path. Recommending administrative commands in a non-admin skill increases operational risk and broadens the skill's effect beyond document generation.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

If not found, detect the OS and offer to install:
- **macOS**: `brew install --cask mactex-no-gui` (smaller) or `brew install --cask mactex`
- **Linux (Debian/Ubuntu)**: `sudo apt-get install texlive-xetex texlive-fonts-recommended texlive-latex-extra`
- **Linux (Fedora)**: `sudo dnf install texlive-xetex texlive-collection-fontsrecommended`
- **Windows**: Download and install MiKTeX from miktex.org

**1b. Check Maple Mono font** (preferred monospace font):

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to enumerate PDF, Markdown, and JSON files in the working directory and common subfolders to locate resumes, even when the user has not explicitly provided a file path. This broad discovery behavior can expose unrelated personal documents and increases the chance of accessing sensitive data beyond what is necessary for the requested task.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Forcing the resume language to match the JD language without confirming user preference can override user intent and produce output in an undesired language. This is primarily a safety and consent issue rather than a direct security exploit, but it still reflects overreach by the skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The skill instructs downloading a font archive from the internet and installing it locally, which introduces an external supply-chain dependency into an otherwise document-generation workflow. Even though the source is a plausible official GitHub project, fetching a latest-release artifact without checksum/signature verification can expose the user to tampered or unexpected content.

Content

Scanner excerpt · references/latex-template.md (reported line 48)May include surrounding context.

Linux (manual install):

bash

# Download the latest release
curl -L -o /tmp/MapleMono.zip "https://github.com/subframe7536/maple-font/releases/latest/download/MapleMono.zip"
mkdir -p ~/.local/share/fonts
unzip -o /tmp/MapleMono.zip -d ~/.local/share/fonts/MapleMono
fc-cache -fv

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

Installing files into ~/.local/share/fonts creates persistent changes outside the project workspace, altering the user's environment beyond the immediate resume task. In skill context, that is more sensitive because resume generation should generally remain ephemeral unless the user explicitly requests system customization.

Content

Scanner excerpt · references/latex-template.md (reported line 49)May include surrounding context.

bash

# Download the latest release
curl -L -o /tmp/MapleMono.zip "https://github.com/subframe7536/maple-font/releases/latest/download/MapleMono.zip"
mkdir -p ~/.local/share/fonts
unzip -o /tmp/MapleMono.zip -d ~/.local/share/fonts/MapleMono
fc-cache -fv
rm /tmp/MapleMono.zip

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The workflow states that a JD may be provided as a URL, which implies the skill may retrieve external web content. Network access is not mentioned in the manifest description, and fetching remote pages is not necessarily an obvious requirement when the user could instead paste the JD text or provide a file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The compilation procedure directs the skill to create a directory, write a .tex file, move a generated PDF, and delete intermediate files. While these actions are operationally normal for the skill, this markdown section does not explicitly warn the user that files in the working directory will be created, moved, and cleaned up.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.