resume-photo

• Outcome: Review
• Latest audit: Oct 16, 2026 · 2:19 AM UTC
• Version: 1.1.0

Overview

The skill does what it claims, but it can send personal portrait photos to external image providers without a clear privacy or consent warning.

Review before installing if you will use real face photos. The skill may upload the source image and prompt to a configured provider such as Google, OpenAI, OpenRouter, fal, xAI, or MiniMax, and it may save generated files under a local Desktop folder. Use only photos you have permission to process, check which provider/model is selected, and avoid sensitive images unless you accept that provider's data handling terms.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README states that users need configured credentials for multiple third-party providers, but it does not clearly warn that uploaded personal photos may be transmitted to those external services for processing. Because the skill handles sensitive biometric-style portrait data, lack of transparent disclosure can cause users to unknowingly share personal images with outside processors, creating privacy, consent, and compliance risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a simple photo-transformation utility, but its documented behavior includes provider discovery, credential-dependent model selection, and subprocess-based inspection of local/backend resources. This mismatch is dangerous because users may provide local paths, images, and trust assumptions without realizing the skill performs broader environment interaction than the description suggests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Natural-language policy review applies to all file types. The visible user-facing instructions are entirely in Chinese and do not offer an alternative language or explain that the skill is intentionally limited to a Chinese-speaking audience, which can constitute a language policy violation under the stated rule.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This README is a markdown file, so vague trigger review applies. The phrase '直接说人话即可' plus generic examples like '给我三个背景颜色的版本' do not define clear trigger boundaries or exclusions, and some examples overlap with ordinary conversational requests rather than a narrowly scoped invocation pattern.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill invokes shell-based scripts and local CLI tooling but does not declare any explicit tool scope or permissions boundary. This creates a transparency and governance gap: users and reviewers cannot easily tell that the skill can execute local commands, inspect configured providers, and access local file paths, which increases the risk of unintended command execution or data exposure in agent environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description is predominantly in Chinese and presents the skill's usage phrasing in Chinese-first form without indicating that users may choose another language. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example instructs the agent to execute a local shell script for image resizing without warning or constraints, which expands the skill's capabilities from image generation into arbitrary local code execution. If the script path, arguments, or surrounding environment are compromised, this can lead to unintended command execution, file access, or modification on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill references third-party image providers and API keys but does not warn that user-supplied photos may be transmitted to external services. Because resume and ID-style photos are sensitive biometric/personal data, undisclosed external transfer creates material privacy and data-handling risk even if the providers are legitimate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script uploads a user-supplied personal photo and prompt to a third-party image-generation provider via openclaw infer image edit without an explicit runtime warning or consent step. Because resume/headshot images contain sensitive biometric and personal data, silent transmission to external services can expose users to privacy, retention, and cross-border data handling risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring is written entirely in Chinese and does not offer any language choice or indicate that the skill is region- or locale-specific. The policy requires flagging language or locale constraints when they are imposed without user opt-in or justification.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/pick_image_model.py (reported line 15)May include surrounding context.

python

def load_providers():
    p = subprocess.run(
        ["openclaw", "infer", "image", "providers", "--json"],
        capture_output=True, text=True,
    )

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The header comments, usage text, preset names, and error/help output are written in Chinese, which imposes a specific language on users. The file does not offer an English alternative, user opt-in, or any justification that this skill is intentionally region- or locale-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file demonstrates the skill saving output files to a specific local path and returning that path to the user, but it does not include any warning or disclosure about local file creation or where artifacts will be stored. For markdown files, omissions around behaviors that affect user data or system state can warrant a missing-warning finding.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The document explicitly labels Chinese as the default in L13 and suggests using the English version when an English provider performs better in L24. This imposes a language/locale preference in the template without offering the user a neutral choice or opt-in mechanism.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Comments, usage instructions, and user-visible messages are written entirely in Chinese, which imposes a language choice on users without opt-in. The file does not indicate that it is intended only for a Chinese-speaking or region-specific environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The script creates the destination directory and writes a generated resume photo to a default path under the user's Desktop. Although this is part of the tool's purpose, the file-writing behavior is only implied by the argument name and final status message, not clearly disclosed in a warning/comment near the operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The script invokes an external command via subprocess to query available image providers, but there is no comment, docstring detail, or user-facing log indicating that it will execute the openclaw CLI. For code files, subprocess execution can warrant a warning when there is no visible disclosure at all, and this file only describes the output and ranking behavior.

Content

No source excerpt is available for this finding.