Resume Editor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:28 AM UTC
• Version: 1.3.4

Overview

This resume skill is mostly coherent and local-first, but editable mode starts a localhost write server and its cleanup can signal local processes based on unauthenticated sidecar files.

Before installing, decide whether you need editable browser sync. For sensitive resumes, prefer --no-sync or Copy JSON, stop any sync server after use, do not share generated editable HTML while the server is running, and avoid untrusted PDFs until the PyMuPDF dependency is reviewed or updated.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_html.py:2059

Finding

Untrusted Sync Sidecar Can Cause Termination of an Unrelated Process

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description promises an end-user resume authoring/editing tool with import/export and translation features. The code chunk only validates an existing JSON resume file against built-in checks and an optional schema. This is a materially different primary purpose. While validation could be a supporting utility inside a resume skill, the declared description does not describe validation as the main function of this code, and none of the advertised major features are present in the supplied chunk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

| `scripts/generate_html.py` | Generate styled HTML from resume JSON |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md

| `scripts/generate_html.py` | Generate styled HTML from resume JSON |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

| `scripts/export_resume.py` | Unified entrypoint for HTML/PDF export |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 48)May include surrounding context.

Option 3: Manual workspace install

bash

mkdir -p ~/.openclaw/workspace/skills
git clone https://github.com/chijiang/resume-editor.git ~/.openclaw/workspace/skills/resume-builder

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

Option 1: Global skill install

bash

mkdir -p ~/.claude/skills
git clone https://github.com/chijiang/resume-editor.git ~/.claude/skills/resume-builder

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README says the skill 'auto-detects when you're working on resumes' and provides broad natural-language triggers such as 'help me update my CV' or 'format my resume'. In agent ecosystems, broad activation criteria can cause the skill to engage on loosely related conversations, increasing the chance that resume content, local files, or export actions are invoked without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to use shell commands, read and write local files, and access network resources (for example https:// photo URLs and package installation), but it declares no explicit tool or permission scope. That creates an over-privileged integration pattern where a resume-related prompt could trigger filesystem changes, command execution, dependency installation, or network access without clear policy boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation criteria are very broad ('whenever a user mentions resumes, CVs, or curriculum vitae'), which can cause the skill to trigger in ordinary conversation and unnecessarily expose file, shell, and network-capable behavior. Over-broad routing increases the chance that an unrelated prompt or a prompt-injected document gets handled by a powerful skill context that can modify local files and invoke external tools.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The workflow directs the agent to autonomously re-read resume.json, apply corrections, and generate final output after the user clicks Save, reducing explicit user review over file modifications. In this skill's context, that autonomy is more dangerous because the editable HTML sync flow writes to disk via a local server, so imported or edited content could be transformed and persisted without a final confirmation checkpoint.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md

- Edit text directly, add/remove bullet items where controls appear.
   - In body fields (summary, descriptions, achievement/responsibility list items, project achievements, honors), the user can select text and apply **B** / *I* / U / color from the toolbar. Title and short fields stay plain by design.
   - When finished, click **Save** in the toolbar — this writes the edited resume back to `resume.json` on disk through a local sync server that the export step starts automatically.
3. Once the user tells you they clicked Save, **re-read `resume.json` yourself** to pick up the changes. Do not ask the user to paste JSON.
4. **Final review**: Check the updated content for grammar, spelling, consistency, formatting, and section separation quality. Suggest corrections if needed.
5. Apply any corrections to `resume.json`.
6. Generate the final, non-editable version for export (HTML or PDF) using the standard export command without `--editable`.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This JSON example is entirely populated with Chinese names, locations, descriptions, and language labels, which can imply that the skill expects or defaults to Chinese output. For a generally reusable resume example, this is a natural-language locale constraint that is not documented as region-specific or optional.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: pymupdf==1.26.5 — 2 advisory(ies): CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py); CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py)

Medium

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The dependency is pinned to PyMuPDF 1.26.5, which the finding reports as affected by a path traversal issue in its CLI-related main.py. Even though this file is only a dependency manifest, shipping a known vulnerable version is a real supply-chain risk if the vulnerable code path is reachable during PDF import or related tooling use. In a resume-builder skill that processes user-supplied PDFs, dependency flaws are more concerning because attackers can provide crafted inputs or trigger auxiliary file-handling flows.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/export_resume.py (reported line 95)May include surrounding context.

python

generate_html_cmd.extend([args.resume_json, str(html_output)])

    print(f"Generating HTML resume with theme '{args.theme}' in {args.lang}...")
    subprocess.run(generate_html_cmd, check=True)

    if args.format == "pdf":
        print(f"Converting HTML to PDF: {final_output}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/export_resume.py (reported line 99)May include surrounding context.

python

if args.format == "pdf":
        print(f"Converting HTML to PDF: {final_output}")
        subprocess.run(
            [
                sys.executable,
                str(script_dir / "generate_pdf.py"),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The generated HTML sends resume data via fetch to a localhost service, which is still an external transmission from the browser and exposes sensitive personal information to a local HTTP endpoint. Because the authorization token is embedded client-side, any in-page script compromise or accidental sharing of the HTML can leak both the resume contents and the ability to overwrite the backing file.

Content

Scanner excerpt · scripts/generate_html.py (reported line 970)May include surrounding context.

python

var originalLabel = saveBtn.textContent;
        saveBtn.textContent = {json.dumps(labels["saving"], ensure_ascii=False)};

        fetch('http://127.0.0.1:' + cfg.port + '/sync', {{
            method: 'POST',
            headers: {{
                'Content-Type': 'application/json',

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · scripts/generate_html.py (reported line 970)May include surrounding context.

python

var originalLabel = saveBtn.textContent;
        saveBtn.textContent = {json.dumps(labels["saving"], ensure_ascii=False)};

        fetch('http://127.0.0.1:' + cfg.port + '/sync', {{
            method: 'POST',
            headers: {{
                'Content-Type': 'application/json',

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The HTML generator embeds a bearer token and localhost sync endpoint into the produced HTML, then enables browser-originated writes back to the source resume JSON. Any script running in the same page context, or anyone with access to the generated HTML file, can extract that token and invoke the local write API, turning a viewer/editor into a file-modification channel on the host.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This renderer also manages OS processes and kills PIDs based on sidecar-file contents associated with the target path. If an attacker can tamper with a matching sidecar file in the directory, they may be able to cause termination attempts against arbitrary local processes owned by the same user, creating a local denial-of-service condition.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_html.py (reported line 2008)May include surrounding context.

python

try:
        # Suppress SIGINT inheritance so Ctrl-C on the parent doesn't kill
        # the server mid-write. We rely on the sidecar file for cleanup.
        proc = subprocess.Popen(
            [sys.executable, str(server_script), "--target", target_path],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,

Static analysis

No suspicious patterns detected.