Resume Ats

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:36 AM UTC
• Version: 0.1.1

Overview

This appears to be an incomplete but coherent resume/ATS CLI skill with local configuration and local storage behavior, not hidden exfiltration or malicious control behavior.

Before installing, prefer the local editable install from the reviewed source instead of the unpinned pipx command. Treat resumes and job descriptions as sensitive personal data: review the configured DB_PATH and avoid putting secrets in .env beyond the optional API key needed for future AI features. Expect many advertised functions to be placeholders in this version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:28

Finding

Unverified Remote Package Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-30
Vulnerability Type: Unpinned package-index installation
Risk Level: Medium

Vulnerable Code Snippet:

bash

pipx install resume-ats

Technical Analysis

The installation instructions direct users to install resume-ats from the package index configured for pipx. The command does not specify a version, cryptographic hash, verified repository URL, or signed artifact. It therefore does not bind the installed package to the source code that was audited.

The effective code installed by this command can change after the skill has been reviewed. If the indexed package is compromised, replaced, transferred to a malicious maintainer, or resolved through a malicious package mirror, users may install attacker-controlled code while believing they are installing this project.

This is a dependency and distribution-chain weakness. The audited local source does not itself retrieve or execute a payload through this command; exploitation depends on an attacker gaining control over package resolution or the remotely distributed package.

Attack Path

1. An attacker compromises or otherwise gains control of the resume-ats distribution on the configured Python package index, or causes the victim to use a malicious package mirror.
2. The attacker publishes a malicious release under the package name expected by the documentation.
3. A user follows SKILL.md and runs pipx install resume-ats.
4. pipx retrieves and installs the remotely supplied distribution without verifying that it corresponds to the audited project revision.
5. Attacker-controlled code can execute when exposed installation behavior is triggered or when the installed resume-ats command is invoked.

Impact Assessment

Successful exploitation would execute attacker-controlled Python code with the privileges of the user running pipx. This could permit access to files, envi ...[truncated 445 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer installation from the reviewed local source tree:

   bash

   pipx install .
   

2. If package-index installation must be supported, pin an exact trusted release:

   bash

   pipx install "resume-ats==0.1.0"
   

3. Publish releases through a controlled CI/CD pipeline and use signed release artifacts or package-index trusted publishing.
4. Provide cryptographic checksums for distributed artifacts and document a verification step before installation.
5. Maintain a lock file with hashes for transitive dependencies where the deployment workflow supports it.
6. Ensure that the package name, publisher identity, source repository, and release version are explicitly documented so users can verify that the retrieved package matches the audited project.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · resume_ats/cli.py (reported line 24)May include surrounding context.

python

@app.command()
def init(
    force: bool = typer.Option(False, "--force", "-f", help="Overwrite existing config"),
) -> None:
    """
    Initialize configuration for resume/ATS optimization

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

if not typer.confirm("Do you want to overwrite?"):
            return

    # Create .env from example
    example_path = Path(__file__).parent.parent / ".env.example"
    if example_path.exists():
        import shutil

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · resume_ats/cli.py (reported line 36)May include surrounding context.

python

if not typer.confirm("Do you want to overwrite?"):
            return

    # Create .env from example
    example_path = Path(__file__).parent.parent / ".env.example"
    if example_path.exists():
        import shutil

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · resume_ats/cli.py (reported line 43)May include surrounding context.

python

if not typer.confirm("Do you want to overwrite?"):
            return

    # Create .env from example
    example_path = Path(__file__).parent.parent / ".env.example"
    if example_path.exists():
        import shutil

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · resume_ats/cli.py (reported line 29)May include surrounding context.

python

"""Application settings"""

    model_config = pydantic_settings.SettingsConfigDict(
        env_file=".env",
        env_file_encoding="utf-8",
        case_sensitive=False,
    )

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · resume_ats/config.py (reported line 15)May include surrounding context.

python

"""Application settings"""

    model_config = pydantic_settings.SettingsConfigDict(
        env_file=".env",
        env_file_encoding="utf-8",
        case_sensitive=False,
    )

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README content, including usage instructions and descriptions, is written in Japanese and does not indicate that users may choose another language. Per the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is justified and documented.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The high-level description states that the tool carries out substantive resume and ATS optimization functions. However, the implemented-features section says only scaffolding-level capabilities exist, so the overview overstates actual behavior and conflicts with the document's own implementation status.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README presents concrete commands for analyze, score, keywords, and generate as if those capabilities are available. Later, the '機能予定' section explicitly lists PDF parsing, ATS scoring, keyword optimization, templates, and resume generation as not yet implemented, which directly contradicts the earlier usage documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file presents core usage documentation in Japanese starting at the overview section, while earlier content is in English. This imposes a language preference on users without opt-in or explanation, which matches the policy category for language/locale violations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document presents PDF/text parsing, ATS scoring, keyword extraction, template generation, and section reorganization as current 'main features' and provides concrete CLI commands to use them. Later, the same file states these same capabilities are merely planned for future implementation, which directly contradicts the earlier documentation about what the skill currently does.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code writes potentially sensitive resume and job-description text, keywords, and scores into a local SQLite database via save_resume and save_job_description. Although the methods have brief docstrings, there is no user-facing warning, confirmation, or visible disclosure that personal document contents will be stored on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file documents resume-ats generate --output optimized_resume.pdf, which affects user data by writing a file. The surrounding description explains the feature but does not include any warning or note about file creation or possible overwrite behavior.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pyyaml has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pypdf2 has 8 known advisory(ies) (CVE-2023-36464 (pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a chara); CVE-2023-36807 (PyPDF2 vulnerable to possible Infinite Loop when reading malformed objects); CVE-2023-36810 (PyPDF2 quadratic runtime with malformed PDF missing xref marker) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: black has 5 known advisory(ies) (CVE-2026-32274 (Black: Arbitrary file writes from unsanitized user input in cache file name); CVE-2024-21503 (Black vulnerable to Regular Expression Denial of Service (ReDoS)); CVE-2024-21503 (Versions of the package black before 24.3.0 are vulnerable to Regular Expression) +2 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.