简历评估

• Outcome: Review
• Latest audit: Jun 14, 2026 · 11:56 AM UTC
• Version: 1.0.1

Overview

This resume-review skill does what it claims, but it sends full candidate materials to an external model API without a clear user-facing privacy or consent warning.

Install only if your organization permits sending resumes, JD text, and company background to the configured external model provider. Review config/model.yaml, confirm the provider and retention terms, use only approved endpoints and API keys, and consider redacting candidate PII or disabling raw JSON output before processing real applicants.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill instructs the agent to access environment variables, read local files, write reports, invoke a shell command, and use a model API, but it declares no permissions or trust boundaries. That mismatch is a real security issue because it can cause over-privileged or opaque execution, making sensitive resume data and API secrets accessible without explicit authorization controls or user-visible consent.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: The skill appears to send resume, job-description, and related evaluation content to an external HTTP API, which creates a data-transfer risk because resumes commonly contain sensitive personal and employment information. The danger is amplified by the lack of explicit disclosure in the skill description, so users may provide candidate data without realizing it leaves the local environment.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This code sends full resume text plus optional job-description and company context to an external model evaluator via build_messages/evaluate_with_model, but this file provides no disclosure, consent gate, minimization, or redaction before transmission. Because resumes commonly contain sensitive personal data, the risk is unauthorized exposure of candidate PII to a third-party model provider or downstream logging/retention systems.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function sends full resume, JD, and company text to a configurable external endpoint, which can include sensitive personal data, employment history, and potentially special-category information. In an HR screening context this is particularly risky because the code provides no in-band consent check, destination allowlisting, redaction, or minimization before transmission.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The summary indicates the skill both accesses an API key from the environment and performs outbound HTTP requests, yet there is no user-facing warning or disclosure. This is dangerous because the skill handles HR documents, so undisclosed external transmission can expose sensitive candidate information and undermine informed consent and compliance expectations.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The fixture contains explicit age and marital-status attributes, which are sensitive or protected personal data in many hiring contexts and can enable discriminatory processing if ingested by the resume-evaluation skill. In an HR screening skill, including these fields without clear necessity, consent, or localization controls increases compliance risk because downstream prompts, scoring, or reports may normalize use of protected attributes.

External Transmission

Medium

• Category: Data Exfiltration

Content

for attempt in range(max_attempts):
        attempts = attempt + 1
        try:
            response = requests.post(
                config.endpoint,
                headers=headers,
                json=payload,

• Confidence: 96% confidence
• Finding: requests.post( config.endpoint, headers=headers, json=

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.