ClawHub
Back to skill

Security audit

反AI简历筛查助手

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese-language resume and ATS optimization guide that asks for resume/JD content only for that purpose and does not install code, persist data, or access credentials.

Use this skill only with resume and job-description information you are comfortable sharing with the agent. It is mainly designed for Chinese-language resumes, so specify another language or market if needed, and review any rewritten achievements carefully to ensure they remain truthful.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger scope is overly broad because it includes generic, high-frequency phrases such as “求职” and “面试准备,” which can cause the skill to activate outside the intended resume-optimization context. This creates prompt-routing risk: users in broader job-seeking conversations may be unexpectedly routed into resume analysis flows, potentially causing irrelevant collection of resume/JD content or unintended behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Declaring a default of Chinese resumes without first confirming user preference can impose a locale/language choice that the user did not request. In practice this can lead to unwanted transformations, degraded output quality for non-Chinese resumes, or accidental mishandling of multilingual content, especially in international recruiting contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructional content exclusively in Chinese, with no opt-in, alternative language path, or stated regional justification, which can amount to forcing a specific language on users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file presents all guidance exclusively in Chinese, and there is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. This file presents all guidance exclusively in Chinese and does not provide any opt-in, alternative language option, or justification for restricting the content to a single language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file contains user-facing instructions and labels exclusively in Chinese, which can constitute a language/locale policy issue when no user opt-in or alternative language option is offered. The file does not indicate that it is intended only for a Chinese-language or region-specific context.

Content

No source excerpt is available for this finding.