Resume Editor

• Outcome: Review
• Latest audit: Jul 1, 2026 · 8:55 PM UTC
• Version: 1.3.4

Overview

This resume skill mostly matches its stated purpose, but review is warranted because it can start a lingering local write-back server and includes an under-scoped theme helper that can delete arbitrary directories when forced.

Install only if you are comfortable with a local resume tool that reads and writes sensitive resume files. Avoid editable mode unless you need browser-based editing, stop the sync server when finished, keep editable HTML private, do not use --force or arbitrary --output-dir with the theme script unless you have backups, and update or isolate the PDF dependency before opening untrusted PDFs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly instructs use of shell commands, local file reads/writes, PDF import/export tooling, and network-capable inputs such as `https://` photo URLs, yet it declares no permissions or trust boundaries. This creates a capability/expectation mismatch that can lead an agent to perform sensitive actions without explicit authorization controls, especially when handling user-provided paths, PDFs, and export destinations.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script accepts an arbitrary --output-dir and, when --force is provided, unconditionally calls shutil.rmtree(target_dir) before recreating it. Because the path is not constrained to the skill's theme directory or otherwise safety-checked, a user or calling agent can delete or overwrite unrelated filesystem locations, which exceeds the stated resume-theme scaffolding purpose and creates a destructive file-system primitive.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The file does more than generate HTML: in editable mode it starts a persistent local sync server, embeds credentials into browser-consumable HTML, and enables save-back to disk. That materially increases the attack surface and handling of sensitive resume data beyond what users would expect from a formatting/export skill, especially because resumes often contain PII.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: Spawning a background sync subprocess introduces a persistent local service that survives the main process and can receive browser-originated write requests. Even if intended for convenience, this exceeds normal resume rendering scope and creates additional opportunities for misuse, especially on shared or monitored systems handling personal data.

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: The code enumerates sidecar files and sends termination signals to PIDs recorded there if they appear to match the target resume path. Killing local processes based on filesystem metadata is dangerous because stale or tampered sidecar files could cause unintended termination of unrelated processes if PID reuse occurs or metadata is manipulated.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The README states the skill 'auto-detects' resume-related work and provides broad trigger examples like 'help me update my CV' and 'format my resume'. In agent ecosystems that invoke skills based on natural-language matching, overly broad activation language can cause the skill to engage in conversations where the user did not explicitly request resume processing, increasing the chance of unintended handling of sensitive personal data or unnecessary tool use.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger text is extremely broad ('whenever a user mentions resumes, CVs, or curriculum vitae') and covers many common requests, which can cause over-invocation of a powerful skill that reads/writes files and runs local tooling. Over-broad routing increases the chance that the skill activates in contexts where its capabilities are unnecessary or where a safer, narrower workflow should be used.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The generated HTML embeds the full resume JSON snapshot and sync configuration, including a bearer token, in the page source accessible to any script executing in that page context. Because resumes contain sensitive personal data, exposing both the data and write-back token in browser-readable markup increases risk from local file compromise, malicious browser extensions, or any future HTML/script injection in custom themes.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Edit text directly, add/remove bullet items where controls appear.
   - In body fields (summary, descriptions, achievement/responsibility list items, project achievements, honors), the user can select text and apply **B** / *I* / U / color from the toolbar. Title and short fields stay plain by design.
   - When finished, click **Save** in the toolbar — this writes the edited resume back to `resume.json` on disk through a local sync server that the export step starts automatically.
3. Once the user tells you they clicked Save, **re-read `resume.json` yourself** to pick up the changes. Do not ask the user to paste JSON.
4. **Final review**: Check the updated content for grammar, spelling, consistency, formatting, and section separation quality. Suggest corrections if needed.
5. Apply any corrections to `resume.json`.
6. Generate the final, non-editable version for export (HTML or PDF) using the standard export command without `--editable`.

• Confidence: 80% confidence
• Finding: Do not ask the user

Known Vulnerable Dependency: pymupdf==1.26.5 — 1 advisory(ies): CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py)

Low

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: pymupdf==1.26.5

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.