Resume Ats

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:36 AM UTC
• Version: 0.1.1

Overview

This appears to be an incomplete but coherent resume/ATS CLI skill with local configuration and local storage behavior, not hidden exfiltration or malicious control behavior.

Before installing, prefer the local editable install from the reviewed source instead of the unpinned pipx command. Treat resumes and job descriptions as sensitive personal data: review the configured DB_PATH and avoid putting secrets in .env beyond the optional API key needed for future AI features. Expect many advertised functions to be placeholders in this version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:28
• Finding: Unverified Remote Package Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 28-30 **Vulnerability Type**: Unpinned package-index installation **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash pipx install resume-ats ``` ### Technical Analysis The installation instructions direct users to install `resume-ats` from the package index configured for `pipx`. The command does not specify a version, cryptographic hash, verified repository URL, or signed artifact. It therefore does not bind the installed package to the source code that was audited. The effective code installed by this command can change after the skill has been reviewed. If the indexed package is compromised, replaced, transferred to a malicious maintainer, or resolved through a malicious package mirror, users may install attacker-controlled code while believing they are installing this project. This is a dependency and distribution-chain weakness. The audited local source does not itself retrieve or execute a payload through this command; exploitation depends on an attacker gaining control over package resolution or the remotely distributed package. ### Attack Path 1. An attacker compromises or otherwise gains control of the `resume-ats` distribution on the configured Python package index, or causes the victim to use a malicious package mirror. 2. The attacker publishes a malicious release under the package name expected by the documentation. 3. A user follows `SKILL.md` and runs `pipx install resume-ats`. 4. `pipx` retrieves and installs the remotely supplied distribution without verifying that it corresponds to the audited project revision. 5. Attacker-controlled code can execute when exposed installation behavior is triggered or when the installed `resume-ats` command is invoked. ### Impact Assessment Successful exploitation would execute attacker-controlled Python code with the privileges of the user running `pipx`. This could permit access to files, envi ...[truncated 445 chars]
• Remediation: ## Remediation Suggestions 1. Prefer installation from the reviewed local source tree: ```bash pipx install . ``` 2. If package-index installation must be supported, pin an exact trusted release: ```bash pipx install "resume-ats==0.1.0" ``` 3. Publish releases through a controlled CI/CD pipeline and use signed release artifacts or package-index trusted publishing. 4. Provide cryptographic checksums for distributed artifacts and document a verification step before installation. 5. Maintain a lock file with hashes for transitive dependencies where the deployment workflow supports it. 6. Ensure that the package name, publisher identity, source repository, and release version are explicitly documented so users can verify that the retrieved package matches the audited project.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Self-Modification

High

• Category: Rogue Agent

Content

@app.command()
def init(
    force: bool = typer.Option(False, "--force", "-f", help="Overwrite existing config"),
) -> None:
    """
    Initialize configuration for resume/ATS optimization

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Credential Access

High

• Category: Privilege Escalation

Content

if not typer.confirm("Do you want to overwrite?"):
            return

    # Create .env from example
    example_path = Path(__file__).parent.parent / ".env.example"
    if example_path.exists():
        import shutil

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

if not typer.confirm("Do you want to overwrite?"):
            return

    # Create .env from example
    example_path = Path(__file__).parent.parent / ".env.example"
    if example_path.exists():
        import shutil

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

if not typer.confirm("Do you want to overwrite?"):
            return

    # Create .env from example
    example_path = Path(__file__).parent.parent / ".env.example"
    if example_path.exists():
        import shutil

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"""Application settings"""

    model_config = pydantic_settings.SettingsConfigDict(
        env_file=".env",
        env_file_encoding="utf-8",
        case_sensitive=False,
    )

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"""Application settings"""

    model_config = pydantic_settings.SettingsConfigDict(
        env_file=".env",
        env_file_encoding="utf-8",
        case_sensitive=False,
    )

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The README content, including usage instructions and descriptions, is written in Japanese and does not indicate that users may choose another language. Per the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is justified and documented.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The high-level description states that the tool carries out substantive resume and ATS optimization functions. However, the implemented-features section says only scaffolding-level capabilities exist, so the overview overstates actual behavior and conflicts with the document's own implementation status.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The README presents concrete commands for analyze, score, keywords, and generate as if those capabilities are available. Later, the '機能予定' section explicitly lists PDF parsing, ATS scoring, keyword optimization, templates, and resume generation as not yet implemented, which directly contradicts the earlier usage documentation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file presents core usage documentation in Japanese starting at the overview section, while earlier content is in English. This imposes a language preference on users without opt-in or explanation, which matches the policy category for language/locale violations.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The document presents PDF/text parsing, ATS scoring, keyword extraction, template generation, and section reorganization as current 'main features' and provides concrete CLI commands to use them. Later, the same file states these same capabilities are merely planned for future implementation, which directly contradicts the earlier documentation about what the skill currently does.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code writes potentially sensitive resume and job-description text, keywords, and scores into a local SQLite database via save_resume and save_job_description. Although the methods have brief docstrings, there is no user-facing warning, confirmation, or visible disclosure that personal document contents will be stored on disk.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This markdown file documents `resume-ats generate --output optimized_resume.pdf`, which affects user data by writing a file. The surrounding description explains the feature but does not include any warning or note about file creation or possible overwrite behavior.

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Unverifiable Dependency: pyyaml has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Unverifiable Dependency: pypdf2 has 8 known advisory(ies) (CVE-2023-36464 (pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a chara); CVE-2023-36807 (PyPDF2 vulnerable to possible Infinite Loop when reading malformed objects); CVE-2023-36810 (PyPDF2 quadratic runtime with malformed PDF missing xref marker) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Unverifiable Dependency: black has 5 known advisory(ies) (CVE-2026-32274 (Black: Arbitrary file writes from unsanitized user input in cache file name); CVE-2024-21503 (Black vulnerable to Regular Expression Denial of Service (ReDoS)); CVE-2024-21503 (Versions of the package black before 24.3.0 are vulnerable to Regular Expression) +2 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Static analysis

No suspicious patterns detected.