UP 简历 - 让 Agent 帮你写简历找工作

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:25 AM UTC
• Version: 1.0.1

Overview

This job-search skill is mostly purpose-aligned, but its daily monitoring feature creates persistent scheduled tasks and includes unsafe cron cleanup guidance.

Install only if you are comfortable connecting your resume and job-search activity to the UPCV MCP service. Before enabling daily monitoring, review the exact script and launchd/cron entry, avoid `crontab -r`, pin the MCP package version if possible, and periodically delete reports or ATS records you no longer need.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: job-monitor/SKILL.md:57

Finding

Persistent Scheduled Execution Through launchd or cron

Content

View full analysis

StandardOutPath /tmp/jobsclaw-monitor.log StandardErrorPath /tmp/jobsclaw-monitor.err ``` This introduces avoidable integrity and confidentiality risks on multi-user systems. ### Attack Path 1. A user invokes the job-monitoring Skill. 2. The Agent creates `monitor.sh` containing a non-interactive `claude -p` invocation. 3. On macOS, the Agent creates and loads `com.jobsclaw.monitor.plist`; on Linux, it adds a cron entry. 4. The operating system executes the script every day, including after the original Agent session has ended. 5. E ...[truncated 773 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: job-monitor/SKILL.md:152

Finding

Destructive Guidance Can Remove the User's Entire Crontab

Content

View full analysis

Remediation

View remediation

"$HOME/.jobsclaw/crontab.backup" ``` 4. Remove only the uniquely marked JobsClaw line and preserve all other entries. 5. Show the proposed before-and-after diff and require explicit confirmation before applying it. 6. Verify after removal that the JobsClaw entry is absent and unrelated entries remain intact. 7. If no matching entry exists, stop without changing the crontab. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned npm Package Is Executed During MCP Server Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (43)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The skill explicitly selects and invokes an external model runtime via claude -p inside a scheduled script. This introduces uncontrolled model/provider execution outside the reviewed tool boundary, with repeated unattended prompt processing that may access local context or behave differently over time.

Content

Scanner excerpt · job-monitor/SKILL.md (reported line 71)May include surrounding context.

md

REPORT_FILE="$REPORT_DIR/$TODAY.md"

# 使用 Claude Code 执行查询并生成简报
claude -p "
使用 UPCV MCP Server 执行以下查询并生成 Markdown 简报：

1. 调用 campus.recommend（freshOnly: true）获取 24h 内新发布的校招项目

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to collect highly sensitive personal data including name, phone number, email, city, and website, then send it to external MCP tools, but it does not require a clear privacy notice or explicit consent before transmission. In a resume workflow this context increases risk because the data is directly identifying and may be combined with education and employment history, creating substantial privacy and misuse exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger phrases are broad and map to common natural-language job-seeking requests like '找工作' or '优化简历', increasing the chance that the skill is invoked unintentionally. In this skill's context, unintended invocation matters because it can connect to external services, access synchronized resume data, and steer user actions related to applications and monitoring.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The installation command uses npx @upcv/mcp-server without pinning a specific version, so users may execute whatever package version is current at install/run time. Because MCP servers run code locally and may handle resumes, job-search data, and API keys, a compromised or breaking upstream release could lead to supply-chain compromise or unsafe behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README advertises real-time synchronization between the AI assistant and the UP 简历 web service, plus daily monitoring workflows, but does not clearly warn users that resume content and job activity may be stored, shared across systems, or persist over time. This creates privacy and consent risk, especially because resumes often contain sensitive personal data and monitoring features may continue running after a single conversation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The top-level trigger phrases include broad language such as '找工作' and '投递', which may cause the skill to activate in contexts where the user did not intend to invoke external tools or resume-processing workflows. Over-broad activation increases the chance of unintended data handling, external API use, or local file creation under an unrelated conversation context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to obtain an API key and use an external MCP service for resume creation, editing, and job-search functions, but it does not clearly warn that resume content, job preferences, and related personal data may be transmitted to a third-party service. Given the sensitivity of resumes and application data, this omission materially increases privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs installation of an MCP server via npx @upcv/mcp-server without pinning an exact package version or integrity, so future installs may pull changed or compromised code. Because this package is meant to run locally with API credentials and access to user resume/job-search data, a supply-chain compromise could lead to credential theft or arbitrary code execution in the user's environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The feature trigger table defines multiple ambiguous triggers across job search, resume editing, and monitoring without clear boundaries, making accidental invocation more likely. In this skill, accidental activation is more dangerous because several workflows involve external services, persistence, and potentially sensitive personal/job-application data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill describes saving daily reports under ~/.jobsclaw/reports/ and ATS records under ats-records/ but does not clearly warn users beforehand that local files will be created and retained. This lack of transparent disclosure undermines informed consent and can expose private job-search activity or application metadata to other local users, backups, or endpoint monitoring tools.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill directs the agent to create monitor.sh and configure launchd/cron, which expands a resume assistant into persistent local automation with OS-level execution. That creates unnecessary persistence and a path for unintended recurring network activity, file writes, or later abuse if the generated script is modified or over-privileged.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Persisting ATS form structures in ats-records/ creates local retention of application-related data beyond the immediate user request. Even if the stored data is not always highly sensitive, it can reveal employers, application workflows, and potentially user-specific field mappings, increasing privacy and data exposure risk on shared or compromised systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description is entirely in Chinese and explicitly defines when the skill should be used, but nowhere in the file does it indicate that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is documented and justified.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to install and run an MCP server via npx @upcv/mcp-server without pinning a specific version or checksum. That creates a supply-chain risk: a future compromised or malicious package release could be fetched and executed automatically, potentially exposing resume data, API keys, or local environment access through the MCP server.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill directs the agent to persist ATS experience into memory files but does not clearly warn the user that application-related data may be retained and reused. In this context, ATS records can include structured form fields and potentially sensitive job-application details, so undisclosed persistence increases privacy risk and may lead to over-collection or unintended reuse across sessions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases include broad terms such as '找校招', '有什么校招', and especially '实习项目', which can match ordinary conversation and cause the skill to activate when the user did not intend to invoke it. In a tool-integrated agent, overbroad activation increases the chance of unnecessary external queries, context leakage to the MCP server, and workflow confusion.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to install an MCP server via npx @upcv/mcp-server without pinning a specific package version. This creates a supply-chain risk: future package updates or a compromised published version could change behavior unexpectedly and execute unreviewed code in the user's environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases include broad everyday language such as reminders and recommendations, which can cause accidental invocation in normal conversation. Unintended activation matters more here because this skill contains instructions for creating persistent automation and scheduled jobs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill instructs installing an MCP server via npx @upcv/mcp-server without pinning an exact package version. That causes future executions to resolve whatever version is current at install time, increasing supply-chain risk if a malicious or breaking update is published.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This skill goes beyond providing job-monitoring guidance and instructs the agent to create local scripts and persistent scheduled tasks on the user's machine. Persistent automation increases risk because it creates ongoing behavior and filesystem changes that can outlive the user's immediate consent and can be repurposed if the generated script or inputs are modified later.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description and workflow do not prominently warn that setup creates local files and OS-level persistent scheduled tasks. This lack of disclosure undermines informed consent and raises the chance a user triggers durable system changes without understanding the consequences.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicate occurrence again reflects persistent local report storage under ~/.jobsclaw/reports. The risk is limited but real because the skill silently accumulates user-related artifacts over time.

Content

Scanner excerpt · job-monitor/SKILL.md (reported line 66)May include surrounding context.

md

# 监控条件：[用户设置的条件]

REPORT_DIR="$HOME/.jobsclaw/reports"
mkdir -p "$REPORT_DIR"
TODAY=$(date +%Y-%m-%d)
REPORT_FILE="$REPORT_DIR/$TODAY.md"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicate occurrence again reflects persistent local report storage under ~/.jobsclaw/reports. The risk is limited but real because the skill silently accumulates user-related artifacts over time.

Content

Scanner excerpt · job-monitor/SKILL.md (reported line 66)May include surrounding context.

md

# 监控条件:[用户设置的条件]

REPORT_DIR="$HOME/.jobsclaw/reports"
mkdir -p "$REPORT_DIR"
TODAY=$(date +%Y-%m-%d)
REPORT_FILE="$REPORT_DIR/$TODAY.md"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The generated monitor.sh delegates future work to a generic claude -p invocation, effectively granting an external agent broad autonomy each time the scheduler runs. This is dangerous because the skill's declared MCP tool scope is bypassed, and future prompts or environment changes could cause unintended actions or data access during repeated unattended execution.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The launchd plist creation step establishes OS-level persistence by defining a job that will run automatically on a schedule. Such persistence is risky in an agent skill because it creates durable system modification beyond the immediate user request and can repeatedly execute future commands unattended.

Content

Scanner excerpt · job-monitor/SKILL.md (reported line 104)May include surrounding context.

macOS（launchd）：

创建 ~/Library/LaunchAgents/com.jobsclaw.monitor.plist：

xml

<?xml version="1.0" encoding="UTF-8"?>

Static analysis

No suspicious patterns detected.