ClawHub
Back to skill

Security audit

Resume Builder

Security checks for vulnerabilities and agentic risk

Overview

This resume-building skill behaves like a local resume drafting and PDF rendering helper, with expected handling of resume data and no evidence of hidden network access, credential use, persistence, or destructive behavior.

Install only if you are comfortable giving resume and job-description content to your local agent workflow. Use a dedicated output folder, review or delete generated JSON/Typst/PDF files when finished, and make sure the local typst binary and the missing Typst template are trusted and available.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs the agent to read candidate/job materials, write files, and invoke a shell command (`python3 ...` / `typst`) but declares no permissions or trust boundaries. This creates an undeclared capability gap: operators may authorize the skill assuming it is passive text guidance, while it can actually access local data and execute tooling, increasing the chance of unintended file access or command execution in sensitive environments.

Tp4

High
Category
MCP Tool Poisoning
Confidence
81% confidence
Finding
The skill description promises substantial resume authoring and JD-tailoring behavior, but the material shown primarily provides procedural instructions and a renderer invocation, with no embedded implementation for the claimed transformations. This mismatch is risky because users and orchestrators may trust the skill with sensitive personal data under false assumptions about what is automated, how content is processed, or whether external/manual steps are actually required.

Static analysis

No suspicious patterns detected.