Security audit

Tamar Resume Tailor

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent resume-tailoring purpose, but its instructions can expose sensitive resume data to a third-party service and include unsafe shell command examples.

Review before installing. Only use this with resumes and job descriptions you are comfortable sending to Tamar, confirm each upload or tailoring step, and avoid following the shown shell templates with untrusted pasted text; the CLI should be installed from a pinned, trusted version and invoked with safely separated arguments and secure temporary files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:53
Finding: Shell Command Injection Through Unsafe Quoting of User-Controlled Input
Content: View full analysis
' > /tmp/jd.txt tamar tailor --job /tmp/jd.txt # Safe: single-quote the argument to prevent shell expansion tamar tailor --job 'https://example.com/jobs/12345' ``` ```bash tamar tailor --job /tmp/jd.txt --resume '' ``` ```bash echo '' > /tmp/feedback.txt tamar feedback "$(cat /tmp/feedback.txt)" ``` The same unsafe patterns appear in `instructions.md`: ```bash # Safe: write JD to a temp file, pass the file echo '' > /tmp/jd.txt tamar tailor --job /tmp/jd.txt # Safe: single-quote the argument to prevent shell expansion tamar tailor --job 'https://example.com/jobs/12345' ``` ```bash tamar tailor --job /tmp/jd.txt --resume '' ``` ```bash echo '' > /tmp/feedback.txt tamar feedback "$(cat /tmp/feedback.txt)" ``` ### Technical Analysis The skill instructs the agent to place user-controlled job descriptions, URLs, feedback, and file paths directly inside shell single-quoted strings. It incorrectly characterizes this construction as safe. A single quote contained in the input terminates the quoted shell token. The remaining input can then introduce shell operators such as semicolons, pipelines, command substitutions, or redirections. Merely surrounding an untrusted string with literal single quotes is not equivalent to safely encoding that string as a shell argument. The affected input sources include: - Pasted job-description text - Job-description URLs - Natural-language feedback - User-supplied resume paths The vulnerability is particularly significant because job descriptions may be copied from remote or attacker-controlled sources. If an agent foll ...[truncated 1486 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:57
Finding: Predictable Shared Temporary Files Enable Symlink and Race Attacks
Content: View full analysis
' > /tmp/jd.txt tamar tailor --job /tmp/jd.txt ``` ```bash echo '' > /tmp/feedback.txt tamar feedback "$(cat /tmp/feedback.txt)" ``` Equivalent fixed paths are used in `instructions.md`: ```bash echo '' > /tmp/jd.txt tamar tailor --job /tmp/jd.txt ``` ```bash echo '' > /tmp/feedback.txt tamar feedback "$(cat /tmp/feedback.txt)" ``` ### Technical Analysis The skill uses globally predictable names in the shared `/tmp` directory. The paths are not created atomically, no ownership or file-type verification is performed, restrictive permissions are not established explicitly, and no private temporary directory is used. An attacker with local access may pre-create one of these paths as a symbolic link or replace its contents between the write and read operations. Shell redirection can follow a symbolic link, while the separate write and CLI-read operations create a time-of-check/time-of-use window. The practical exploitability of cross-user symbolic-link attacks may depend on operating-system hardening such as protected-symlink settings. However, same-account processes, weakly configured systems, containers, and race-based content replacement remain exposed. ### Attack Path 1. A local attacker predicts that the skill will use `/tmp/jd.txt` or `/tmp/feedback.txt`. 2. Before the skill runs, the attacker creates the path as a symbolic link to a file writable by the agent, or prepares to replace the temporary file after it is written. 3. The documented `echo ... > /tmp/...` operation follows the path and may overwrite the linked destination. 4. Alternatively, the attacker replaces or modifies the file before `tamar tailor` or `tamar ...[truncated 756 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:4
Finding: Unpinned Global Installation of a Third-Party npm CLI
Content: View full analysis
Remediation: View remediation
``` 2. Publish and verify an integrity hash, package signature, or provenance attestation for the approved release. 3. Document the expected npm registry and verified publisher identity. 4. Audit the pinned release and its complete transitive dependency tree. 5. Prefer a project-local or otherwise isolated installation over a global package installation. 6. Disable lifecycle scripts where feasible, or separately review every required lifecycle script before permitting execution. 7. Establish a controlled update process in which new versions are reviewed before changing the pin. 8. Keep the version declared by skill metadata synchronized with the version documented in `SKILL.md`, `instructions.md`, and `README.md`. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README instructs users to upload resumes and job descriptions to a third-party service, which likely involves transmitting sensitive personal and employment data off-device, but it does not clearly warn users about that data flow or privacy implications. Because resumes commonly contain PII, employment history, contact details, and potentially confidential job-application content, the omission can lead users to share sensitive data without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill does not explicitly warn that resumes, job descriptions, and possibly profile data will be sent to the Tamar external API. Because these materials commonly contain sensitive personal and employment information, omission of a clear disclosure can lead to uninformed consent and unintended exposure of private data to a third party.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases are broad enough to match ordinary career-help requests, which can cause the skill to activate in situations where the user did not clearly intend to invoke an external resume-tailoring workflow. In this skill’s context, that matters because activation can lead to reading local files and transmitting resume/job-description content to a third-party API, increasing the chance of unintended data handling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill does not clearly warn that resume contents, job descriptions, and possibly uploaded files will be transmitted to the Tamar AI API. Because resumes and job applications often contain sensitive personal and employment information, lack of explicit disclosure undermines informed consent and can cause unintended third-party data exposure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list is broad enough to match common resume-help requests, which increases the chance the skill activates when a user did not specifically intend to use this third-party Tamar workflow. In this skill, unintended activation is more sensitive because it can lead the agent to collect or process resumes and job descriptions and route them to an external API.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.