Security audit
Security checks for vulnerabilities and agentic risk
This is a simple resume-helper skill whose file handling is disclosed and aligned with creating resumes and interview notes.
Before installing, consider that resumes often contain personal and employment information. Use this skill when you are comfortable providing that content and saving the generated resume or interview notes in your workspace.
The skill metadata description is broad enough to match common resume-related requests without clear activation boundaries. This can cause unintended invocation in ordinary conversations, increasing the chance the skill reads or writes workspace files when the user did not explicitly intend to use this capability.
All user-facing instructions and examples are written as if the skill operates only in Chinese, and there is no indication that users may choose another language. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern unless the regional limitation is documented and justified.
The example requests are written as generic trigger phrases and do not include scope constraints or disambiguation guidance. This makes accidental activation more likely and may lead to unintended file handling, resume generation, or workspace persistence based on ambiguous user statements.
The skill states that resumes and interview documents will be stored in the workspace, but it does not clearly warn the user up front at the point of use. Because these files may contain sensitive personal and employment information, silent persistence creates a privacy and data-handling risk.
No suspicious patterns detected.
