other
Error
- Location
DAY2-REPORT.md:60- Finding
Instructions Solicit Disclosure of Reusable LLM API Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Resume Rocket
Security checks for vulnerabilities and agentic risk
Overview
This resume skill is mostly purpose-aligned, but it includes unsafe instructions to send an API key to the publisher and has overbroad URL-fetching and auto-apply behavior that need review.
Install only if you are comfortable with a China-focused resume tool that reads your resume, may fetch JD URLs, and sends resume/JD excerpts to the LLM provider configured with your own key. Do not send API keys, payment screenshots, identity details, or real resumes over chat/private messages to the publisher; configure secrets locally and use sanitized samples where possible. Treat auto-apply as account-affecting automation and use it only with explicit review of each target and low limits.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
lib/jd_fetcher.py:101- Finding
Arbitrary JD URL Fetching Permits Server-Side Request Forgery
- Content
View full analysis
JD: if _is_url(source): host = urllib.parse.urlparse(source).netloc if "zhipin" in host: return _fetch_boss(source) import requests html = requests.get(source, timeout=15).text text = re.sub(r"<[^>]+>", "\n", html) return _parse_text(text[:5000]) return _parse_text(source) ``` The specialized Boss fetcher is also unrestricted: ```python def _fetch_boss(url: str) -> JD: """Use the existing boss-zhipin skill, or fall back to generic HTML retrieval.""" try: import requests except ImportError: raise RuntimeError("Install requests first") headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", } resp = requests.get(url, headers=headers, timeout=15) html = resp.text ``` ### Technical Analysis Any string beginning with `http://` or `https://` is treated as a URL and fetched by the process. The implementation does not enforce a supported-domain allowlist or reject loopback, private, link-local, reserved, or cloud metadata addresses. The substring check `if "zhipin" in host` is not a safe domain validation mechanism. A domain such as `zhipin.attacker.example` or `not-zhipin.example` satisfies the test even though it is not controlled by the intended job platform. Regardless of that branch, both request paths fetch the supplied URL. The code also lacks: - DNS resolution and post-resolution IP validation. - Redirect-target validation. - A response-size limit. - HTTP status validation. - Content-type validation. - A prohibition on cleartext HTTP. - Streaming limits before the response body is placed in memory. A timeout limits request duration but does not prevent SSRF or oversized response consumpti ...[truncated 1928 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
lib/license.py:27- Finding
Public Default Secret Allows Forgery of Paid-Tier Licenses
- Content
View full analysis
str: """ Local offline verification for MVP: Activation code format = tier-YYYYMMDD-hash tier: S(single) / M(monthly) / P(pro) YYYYMMDD: expiration date hash: HMAC(secret, tier+date)[:8] Replace with server verification for production. """ secret = os.getenv("RR_LICENSE_SECRET", "openclaw-resume-rocket-2026") if not license_key or license_key.count("-") != 2: return "free" tier_code, expire, h = license_key.split("-") if datetime.now().strftime("%Y%m%d") > expire: return "free" want = hashlib.sha256(f"{secret}|{tier_code}|{expire}".encode()).hexdigest()[:8] if want != h: return "free" return {"S": "single", "M": "monthly", "P": "pro"}.get(tier_code, "free") ``` The package also includes a generator using the same public default secret at `scripts/gen-license.py:16-23`: ```python def gen(tier: str, expire: str, secret: str = None) -> str: secret = secret or os.getenv("RR_LICENSE_SECRET", "openclaw-resume-rocket-2026") if tier not in ("S", "M", "P"): raise ValueError(f"tier must be S/M/P, got {tier}") if len(expire) != 8 or not expire.isdigit(): raise ValueError(f"expire must be YYYYMMDD, got {expire}") h = hashlib.sha256(f"{secret}|{tier}|{expire}".encode()).hexdigest()[:8] return f"{tier}-{expire}-{h}" ``` ### Technical Analysis The verification secret is embedded in code distributed to every user. Because the client must verify licenses offline using the same symmetric secret used to generate them, anyone who can inspect the package can generate a valid license for any tier and expiration date. The bundled `gen-license.py` utility makes exploitation immediate: an attacker can invoke it dire ...[truncated 2146 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (60)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document explicitly asks the recipient to paste an LLM API key via private message, encouraging direct disclosure of a sensitive credential through an unsafe channel. API keys can be reused to access paid services, exfiltrate data, incur charges, and compromise any systems where the same operator uses the credential.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This is a direct natural-language prompt for the user to disclose an API secret ('把 sk-xxx 粘贴给我'), which normalizes credential sharing and creates a clear path for unauthorized use. In the context of an agent skill, this is especially dangerous because users may trust the workflow and reveal production keys that can be abused immediately.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
License generation, secret-based token creation, and admin CLI behavior are materially outside the user-facing purpose of resume rewriting. When such privileged or operational functionality is bundled into a consumer skill without clear disclosure, it expands the attack surface and raises the chance of misuse, secret mishandling, or unauthorized administrative actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
License generation, secret-based token creation, and admin CLI behavior are materially outside the user-facing purpose of resume rewriting. When such privileged or operational functionality is bundled into a consumer skill without clear disclosure, it expands the attack surface and raises the chance of misuse, secret mishandling, or unauthorized administrative actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
License generation, secret-based token creation, and admin CLI behavior are materially outside the user-facing purpose of resume rewriting. When such privileged or operational functionality is bundled into a consumer skill without clear disclosure, it expands the attack surface and raises the chance of misuse, secret mishandling, or unauthorized administrative actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
License generation, secret-based token creation, and admin CLI behavior are materially outside the user-facing purpose of resume rewriting. When such privileged or operational functionality is bundled into a consumer skill without clear disclosure, it expands the attack surface and raises the chance of misuse, secret mishandling, or unauthorized administrative actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
License generation, secret-based token creation, and admin CLI behavior are materially outside the user-facing purpose of resume rewriting. When such privileged or operational functionality is bundled into a consumer skill without clear disclosure, it expands the attack surface and raises the chance of misuse, secret mishandling, or unauthorized administrative actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
License generation, secret-based token creation, and admin CLI behavior are materially outside the user-facing purpose of resume rewriting. When such privileged or operational functionality is bundled into a consumer skill without clear disclosure, it expands the attack surface and raises the chance of misuse, secret mishandling, or unauthorized administrative actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
License generation, secret-based token creation, and admin CLI behavior are materially outside the user-facing purpose of resume rewriting. When such privileged or operational functionality is bundled into a consumer skill without clear disclosure, it expands the attack surface and raises the chance of misuse, secret mishandling, or unauthorized administrative actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
License generation, secret-based token creation, and admin CLI behavior are materially outside the user-facing purpose of resume rewriting. When such privileged or operational functionality is bundled into a consumer skill without clear disclosure, it expands the attack surface and raises the chance of misuse, secret mishandling, or unauthorized administrative actions.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README documents an internal license-generation and order-management workflow that is unrelated to the declared resume-rewriting/job-application purpose of the skill. This mismatch is dangerous because hidden commercial-control or entitlement logic can indicate undisclosed functionality, broaden the attack surface, and enable misuse if the repository is granted access or distributed under false pretenses.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documented ability to generate activation codes and maintain customer order records is not justified by the stated purpose of the skill, indicating hidden operational behavior beyond user expectations. In a skill ecosystem, undeclared capabilities are risky because they may conceal monetization controls, sensitive-data handling, or admin backdoors that reviewers and users would not anticipate.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest advertises bulk customized auto-submission of resumes without any visible warning that personal data will be sent to third-party job platforms and that account-affecting actions may occur. Because resumes contain sensitive personal information and auto-apply changes the user's external account state, the lack of disclosure and safety constraints materially increases the risk of unauthorized data sharing, spam-like behavior, and platform-account penalties.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The substantive skill description in the changelog is entirely in Chinese, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without opt-in is a natural-language locale violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill asks the user to provide an old resume as a test sample, and although it mentions that redaction is possible, it does not clearly warn against sharing sensitive personal data or set a privacy-safe default. Resumes commonly contain high-risk PII such as phone numbers, email addresses, addresses, work history, and identifiers, so this can lead to unnecessary collection or exposure of personal data during testing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document instructs the user to register a developer account, complete real-name verification, and bind an Alipay payout account without any safety, legitimacy, or privacy guidance. This can pressure users into submitting identity documents, biometric data, and financial account details to a third-party service without adequate validation of data handling risks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
Natural-language policy violations apply to all file types. The report content and the prescribed user replies are entirely in Chinese, with no indication that another language is supported or that the user can choose their preferred language.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The manifest describes a skill focused on rewriting resumes against a target JD and producing a rewritten resume, match score, and interview talking points. This report documents an additional
auto_apply.pymodule for "Pro 批量投递", which is a separate job-application automation capability rather than an obvious implementation detail of resume optimization.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The marketing copy presents a contradictory claim: it says the tool is not a one-click auto-apply product, while elsewhere the paid tier includes Boss automatic delivery. This can mislead users, reviewers, or marketplaces about the actual automation behavior and safety profile, especially because auto-apply features carry platform-abuse, consent, and account-risk implications.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Claiming 'local-first' and 'resume data does not go to the cloud' while also sending content to third-party LLM providers is materially misleading if resume or JD text is included in prompts. This creates a privacy and compliance risk because users may expose sensitive personal and employment data under false assumptions about where their data is processed.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The text states '只测了中文简历，英文简历还没调', which communicates a language limitation without offering any user choice or opt-in path. Under the policy, language constraints should either be optional or clearly justified as region-specific; here it appears as a default product restriction in general marketing content.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 82% confidence
- Finding
The skill advertises capabilities that imply access to local files, network, environment variables, and possibly shell execution, but the manifest does not declare any tool scope or permissions boundaries. This weakens auditability and informed consent: users and the platform cannot easily tell what privileged operations the skill may perform, especially given the handling of resumes, payment/licensing, and optional auto-apply flows.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest description presents the skill as a general-purpose resume rewriting and optional auto-application tool using broad natural language marketing copy, but it does not specify narrow trigger phrases, invocation boundaries, or exclusion conditions. In markdown/manifest scope, this can create ambiguous activation conditions because common job-seeking language could plausibly match the description without clear limits.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The quick-start section shows command usage, but the document never defines a precise set of activation phrases or non-activation cases in natural language. For markdown files, the absence of explicit trigger scope or exclusion examples makes invocation criteria ambiguous.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This file presents the skill content exclusively in Chinese, including headings, instructions, and pricing, with no indication that the user can opt into another language. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.