ClawHub
Back to skill

Security audit

Resume Optimizer

Security checks for vulnerabilities and agentic risk

Overview

This resume optimizer is review-worthy because its documentation misstates how credentials and resume data are handled while the script is designed to send them to an undocumented plaintext API endpoint.

Review carefully before installing. Do not provide a real DeepSeek key or sensitive resume content to this skill unless the publisher fixes the documentation, uses a verified HTTPS endpoint, clearly identifies the data recipient, and obtains consent before upload. If you already used a real third-party API key with it, rotate that key.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/resume_optimizer.py:11
Finding

Sensitive resume data and user credentials transmitted over plaintext HTTP

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:72
Finding

Misleading setup instructions redirect a purported DeepSeek API key to an unrelated endpoint

Content
View full analysis
Remediation
View remediation

other

Warning
Location
SKILL.md:83
Finding

Documented commands and local file workflow do not match the implemented paid remote service

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Note
Location
scripts/resume_optimizer.py:88
Finding

Successful optimization forcibly appends unrelated commercial advertising

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/resume_optimizer.py:11
Finding

Undefined SKILL_ID causes failure during module initialization

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill processes resumes and job descriptions, both of which commonly contain sensitive personal, educational, and employment information, but it does not clearly warn users that this content will be sent to DeepSeek's external API. This undermines informed consent and can result in privacy, confidentiality, or compliance issues if users submit PII or proprietary hiring materials unknowingly.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The user's resume text, which commonly contains sensitive personal data such as name, contact details, employment history, and education, is sent to a remote third-party API without any explicit notice, consent flow, or privacy warning. Because the default API endpoint is an external IP address over plain HTTP, the privacy risk is heightened by possible interception and undisclosed downstream retention.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill requires environment access and communicates with an external API, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: a host may not clearly constrain what the skill can access or transmit, increasing the risk of unintended data exposure from resume contents or API keys.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger conditions are broad enough to match many ordinary career or writing requests, which can cause the skill to activate unexpectedly. In this case that matters because the skill may encourage transmission of sensitive personal and employment data to an external service without the user having explicitly chosen this tool.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The skill is explicitly configured to send data to an external API endpoint. In the context of resume optimization, that transmission likely includes highly sensitive personal data and potentially confidential job descriptions, so the external transmission is security-relevant unless it is clearly disclosed, consented to, and properly minimized.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

bash
export RESUME_API_USER_KEY="你的DeepSeek API Key"
# 可选：自定义API地址
export DEEPSEEK_BASE_URL="https://api.deepseek.com/v1"

第二步：开始优化

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The note '目前只支持中文简历优化' establishes a fixed language constraint. The file does not offer users a language choice, an opt-in flow, or a documented region/compliance justification for restricting operation to Chinese only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

User-facing strings in the module docstring, CLI description, help text, and runtime output are all Chinese-only. This forces a specific language experience without presenting an option to choose locale or documenting a justified regional restriction.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
99% confidence
Finding

The script performs external transmission of user data to a remote API, and in this file the default backend is a hard-coded plain-HTTP endpoint. This exposes sensitive resume contents and account identifiers to interception or tampering in transit and sends data to infrastructure outside the local trust boundary.

Content

Scanner excerpt · scripts/resume_optimizer.py (reported line 24)May include surrounding context.

python
if method == "GET":
            resp = requests.get(url, headers=h, params=data or {}, timeout=30)
        else:
            resp = requests.post(url, headers=h, json=data or {}, timeout=60)
        if resp.status_code >= 400:
            try:
                err = resp.json()

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest describes a narrowly scoped resume-optimization assistant, but the code implements additional SaaS account functions: user registration, account info retrieval, and listing all available AI services. Those behaviors go beyond merely optimizing resumes and introduce a broader service-portal role not reflected in the skill description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The services command enumerates all backend AI services exposed by the remote API, which expands visibility beyond the stated purpose of the skill. This can aid reconnaissance by revealing unrelated capabilities, pricing, and backend surface area to any user able to invoke the script.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.