Security audit

反AI简历筛查助手

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only Chinese resume optimization skill; it handles sensitive resume content but does not install code, request credentials, persist data, or send data elsewhere.

Before using it, remove unnecessary personal details such as national ID numbers, home address, marital status, or private company information from any resume text. Review all rewritten achievements, metrics, and claims carefully so the final resume remains accurate and verifiable, and confirm the target language if you are not writing a Chinese resume.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger conditions are very broad, including generic job-seeking phrases like '求职' and '面试准备', which can cause the skill to activate in many ordinary conversations outside its narrow ATS-resume-optimization purpose. Over-broad routing can lead to incorrect skill selection, unnecessary processing of sensitive resume data, and user confusion about why this specialized workflow was invoked.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: Setting Chinese as the default resume language without explicit user opt-in can cause the skill to rewrite, format, or evaluate content in the wrong language context. In a job-search setting, this may degrade output quality, introduce mismatches with the target role or market, and mishandle user expectations, especially for multilingual or non-Chinese applications.

Static analysis

No suspicious patterns detected.