T09 · Insecure Skill Coding Practices
- Location
SKILL.md:411- Finding
Unnecessary Extraction and Processing of Candidate Contact Information
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 411-425
Vulnerability Type: Excessive processing of personally identifiable information
Risk Level: MediumVulnerable Code Snippet
The following is an English translation of the complete affected prompt:
text Please extract candidate information from the following resume content: Resume content: {resume_text} Extraction requirements: 1. Basic information (name, education, contact information) 2. Total years of work experience 3. Work history (company, position, dates) 4. Skills 5. Project experience 6. Educational background Return the result in JSON format.Technical Analysis
The resume-processing prompt explicitly directs the language model to extract the candidate's contact information. Contact details are not required by the documented five-dimensional scoring algorithm or hiring recommendation logic.
The workflow places the resume content into the model prompt through the
{resume_text}interpolation and asks the model to return the extracted data in structured JSON. This increases the likelihood that unnecessary personally identifiable information will be retained in model context, structured candidate records, diagnostic logs, or downstream analysis.The generic privacy reminder at line 453 does not define or enforce technical safeguards. The Skill does not specify local redaction, field allowlisting, consent verification, retention limits, deletion procedures, access controls, output filtering, or restrictions against including contact details in generated reports.
This is an insecure data-handling practice rather than evidence of intentional data theft. No external exfiltration endpoint or malicious transmission mechanism was identified.
Attack Path
- A user uploads a candidate resume containing a telephone number, email address, residential address, or other contact information.
- The document pars ...[truncated 1370 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove contact information from the extraction requirements because it is not needed for candidate scoring.
- Apply local redaction before sending resume text to a language model. Redact email addresses, telephone numbers, postal addresses, government identifiers, dates of birth, and other unnecessary identifiers.
- Use a strict allowlist for extracted fields, limited to job-relevant qualifications such as skills, experience duration, project history, and education level.
- Avoid extracting the candidate's name unless it is operationally necessary. Use a generated candidate identifier during evaluation where possible.
- Add output validation that rejects or removes contact information from structured model responses and generated reports.
- Require explicit authorization or consent before processing candidate documents through an external model provider.
- Define retention and deletion controls for source documents, parsed text, prompts, model responses, reports, temporary files, and application logs.
- Restrict access to evaluation artifacts according to least-privilege principles and prevent reports from being shared with unauthorized recipients.
- Document the model provider, processing location, retention behavior, and applicable privacy obligations.
- Add automated tests using synthetic PII to verify that sensitive fields are redacted before model invocation and excluded from all exported artifacts.