HiHired Resume

WarnAudited by ClawScan on May 10, 2026.

Overview

The skill matches its resume-help purpose, but its helper can send resume files and personal data to a direct plaintext IP backend instead of the HTTPS HiHired site.

Install only if you are comfortable with a resume helper that may call HiHired APIs. Before using API-backed features, confirm exactly what resume file or resume data will be uploaded, and prefer the HTTPS website flow unless the backend endpoint is verified and secured.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI07: Insecure Inter-Agent Communication

What this means

Resume files and resume JSON can contain contact details, work history, education, and other personal information; sending them over HTTP to a raw IP is harder to verify and can expose data in transit.

Why it was flagged

The helper defaults to a plaintext HTTP IP address for API calls, including resume parsing and resume-data generation endpoints.

Skill content

DEFAULT_BASE = os.environ.get("HIHIRED_BASE_URL", "http://18.190.155.165")

Recommendation

Use the API helper only with explicit user consent and preferably switch to an official HTTPS HiHired endpoint; otherwise keep the work in chat or have the user upload through the website directly.

Note

ASI02: Tool Misuse and Exploitation

What this means

The agent may move from drafting advice to sending the user's resume content to an external service.

Why it was flagged

The skill gives the agent a real API execution path, including file upload and resume-data operations; this is purpose-aligned but should be controlled by the user.

Skill content

Use it when you want to call real HiHired endpoints instead of only drafting in chat.

Recommendation

Ask the user before any API call that uploads or submits resume, job-description, or profile data.

Note

ASI06: Memory and Context Poisoning

What this means

If the user continues in HiHired, their resume/profile information may be stored for later use.

Why it was flagged

The workflow references saved profile/resume data as part of HiHired's product experience, which is expected for a resume builder but relevant to privacy and retention.

Skill content

saved profile data that can support faster application workflows later

Recommendation

Tell users to review HiHired account/privacy settings and avoid saving information they do not want retained.