Cn Resume Analyzer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:32 AM UTC
• Version: 1.2.6

Overview

This skill is a simple Chinese resume review helper with some privacy and dependency cautions, but no evidence of hidden, destructive, or unrelated behavior.

Install only if you are comfortable using a Chinese-focused resume checker. Prefer pasted resume text over file paths or URLs unless you intend the agent to read or fetch that document, and avoid installing optional unpinned dependencies unless remote resume retrieval is actually needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:17
• Finding: Unnecessary Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17-19` **Vulnerability Type**: Unpinned and unnecessary third-party dependency **Risk Level**: Low ### Code Snippet ```yaml install: | No additional dependencies; the Python standard library is used. pip install requests ``` The explanatory text above is an English rendering of the installation block. The executable installation command is reproduced verbatim. ### Technical Analysis The installation instructions recommend installing `requests` without a fixed version, integrity hash, or lock file. The bundled implementation imports only `sys` and `re`; it neither imports `requests` nor implements URL retrieval. Consequently, this dependency is unnecessary for the audited code and expands the software supply-chain attack surface without providing current functionality. An unpinned installation allows the package resolver to select a release that may differ across installations. If the configured package index, dependency resolution path, or a future package release is compromised, package installation logic could execute attacker-controlled code. The audited project does not itself contain evidence of dependency confusion, typosquatting, or a malicious package, so the finding is limited to unsafe dependency guidance. ### Attack Path 1. A user follows the Skill installation instructions. 2. The user runs `pip install requests` against a configured external package index. 3. The resolver selects an unpinned package release and any applicable dependencies. 4. If the package source, selected release, or package index is compromised, installation-time code may execute under the privileges of the user running `pip`. 5. The compromised dependency may then affect the local Python environment even though the current script does not require it. ### Impact Assessment Potential impact is limited to the environment and privileges under which the package is installed. A compromised dependency could ...[truncated 268 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `pip install requests` instruction because the current implementation uses only the Python standard library. 2. If URL retrieval is implemented later, explicitly import and use the dependency only in that feature. 3. Pin the dependency to an audited version rather than allowing unconstrained resolution. 4. Record cryptographic hashes in a lock file or requirements file and require hash verification during installation. 5. Use a trusted package index and install dependencies inside an isolated virtual environment. 6. Document that remote resume retrieval is optional and ensure local-text analysis does not require network-related packages. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/resume_analyzer.py:104
• Finding: Malformed Short-Input Handling Causes an Unhandled CLI Exception<![CDATA[ ## Vulnerability Details **File Location**: `scripts/resume_analyzer.py:17-18, 104-107` **Vulnerability Type**: Inconsistent return schema and unhandled exception **Risk Level**: Low ### Code Snippet ```python if not text or len(text.strip()) < 50: return {"error": "Resume content is too short; provide a more complete resume"} ``` ```python result = analyze_resume(text) print(f"\nResume analysis report") print(f"{'='*40}") print(f"Score: {result['score']}/100 ({result['grade']})") ``` The user-facing strings above are English renderings of the original localized strings. The control flow, dictionary keys, and vulnerable field accesses are unchanged. ### Technical Analysis `analyze_resume()` normally returns a dictionary containing `score`, `grade`, `keywords_found`, and `suggestions`. For empty input or input shorter than 50 characters, however, it returns a dictionary containing only `error`. The command-line entry point does not test for the `error` field before accessing `result['score']` and `result['grade']`. These missing-key accesses raise an unhandled `KeyError`. Subsequent accesses to `keywords_found` and `suggestions` would have the same problem if execution reached them. This is a local availability and robustness flaw rather than a code-execution vulnerability. No shell command, dynamic evaluation, unsafe deserialization, or privilege-boundary bypass is involved. ### Attack Path 1. The script is invoked with empty input or resume text shorter than 50 characters. 2. `analyze_resume()` returns only an `error` field. 3. The command-line renderer unconditionally accesses `result['score']`. 4. Python raises a `KeyError`. 5. The process terminates without returning a controlled validation message or usable analysis report. An untrusted caller able to repeatedly submit short input could repeatedly fail individual analysis invocations. The provided code does not expose a persistent network service, so no broader service-wide denial ...[truncated 375 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Check for the error result before rendering normal report fields: ```python result = analyze_resume(text) if "error" in result: print(f"Error: {result['error']}", file=sys.stderr) sys.exit(1) ``` 2. Prefer a consistent return schema, such as always returning `success`, `error`, `score`, `grade`, `keywords_found`, and `suggestions`. 3. Add automated tests for empty standard input, whitespace-only input, input shorter than 50 characters, and valid input. 4. Return a documented nonzero exit status for validation failures. 5. Avoid exposing an uncaught traceback in user-facing integrations; catch expected validation errors at the command-line boundary. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The skill description, invocation guidance, and handler instructions are written entirely in Chinese and present the skill as a Chinese resume-analysis tool, but there is no statement that the locale is intentionally limited or that users may choose another language. This creates a natural-language policy issue because the skill appears to enforce a specific language by default without opt-in.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrases and scope are broad enough to activate on common resume-help requests without clear constraints or confirmation. In practice, this can cause unintended invocation of the skill and unnecessary processing of sensitive resume data, especially because resumes often contain personal identifiers, employment history, and contact information.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The workflow explicitly allows obtaining resume content from file paths or URLs, but the skill description does not warn users about the privacy and security implications. This is risky because resumes are highly sensitive documents, and fetching from local paths or remote URLs can expose personal data, trigger unintended local file access, or retrieve data from untrusted sources.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The natural-language interface, docstrings, error messages, and printed output are all written in Chinese, and the analysis rules are tailored to Chinese resume conventions and keywords. There is no indication that users can choose another language or that the locale restriction is explicitly documented as a justified region-specific constraint.

Static analysis

No suspicious patterns detected.