ClawHub
Back to skill

Security audit

Cn Resume Analyzer

Security checks across malware telemetry and agentic risk

Overview

This skill is a simple local Chinese resume analyzer, with no evidence of hidden data collection, persistence, destructive behavior, or privileged access.

Install only if you are comfortable having resume text processed by this local helper and receiving Chinese-language output. Avoid giving it resumes or URLs containing sensitive personal details unless that is necessary for your review task; the included script itself does not send data over the network.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The activation rules are broad and example-driven rather than tightly scoped, so the skill may trigger on many generic resume-related requests without clear user consent or disambiguation. In an agent environment, overbroad invocation can cause unintended processing of sensitive personal data in resumes, file paths, or URLs and can route users into this skill when another tool or safer workflow was intended.

Natural-Language Policy Violations

Medium
Confidence
82% confidence
Finding
The skill content is written to operate in Chinese without offering language negotiation, which can cause misleading outputs, incorrect interpretation of user resumes, or accidental mishandling when the user's preferred language differs. While not directly a security exploit by itself, this rigid behavior can increase operational risk in a context involving sensitive personal employment data by reducing transparency and user control.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.