简历 × JD 双向核对·逐条挂原话

• Outcome: Review
• Latest audit: Nov 2, 2026 · 11:06 PM UTC
• Version: 0.1.3

Overview

Review is recommended because the tool can falsely certify résumé reports, and its optional remote processing needs clearer privacy disclosure.

Prefer local processing for private résumés. Supply both originals and review quotations and [待人工] lines yourself; PASS can overstate what was checked. Before remote parsing, confirm which documents or URLs the provider receives and its retention practices, which remain unverified here. Review the installed revision and choose an output path that can safely be overwritten.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The local-only resource access and avoidance of ranking or hiring judgments match the description. The material discrepancy is the delivered result: this code extracts JD requirements and leaves the essential comparison work to a human. It could serve as a supporting collector in a larger workflow, and the separately named check_fit.py might provide validation elsewhere, but neither the completed comparison nor those checks is demonstrated by the supplied chunk.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

bash scripts/fixtures/run_fixtures.sh # 离线三档一次跑完，末行自报档数与不合枚数

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The installation command invokes an unpinned npm executable and installs skill content without an immutable revision. Although this is not itself an MCP server reference, a compromised future dependency or repository update could introduce executable code or malicious agent instructions.

Content

No source excerpt is available for this finding.

The report contract requires Chinese-language conclusion elements without offering a language choice.

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

The checker requires the conclusion to contain 条 and one of 未取到／无证据／只有部分证据, rejecting output without these Chinese-language structures. This imposes a language requirement without user opt-in or an explanation of why a locale restriction is necessary.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The documented installation command leaves both the npm CLI version and skill repository revision mutable. This is a supply-chain exposure rather than an MCP-version issue: a compromised upstream release could execute code or install malicious skill instructions.

Content

No source excerpt is available for this finding.

The remote parsing workflow lacks a warning that resume data or source URLs may be disclosed to an external parsing service.

Medium

• Category: Output Handling
• Confidence: 95% confidence

Finding

The remote workflow routes document references or content through an external parsing service without clearly explaining that disclosure. Résumés contain personal information, and source URLs may contain access tokens; installation or spending consent and a general notice about report sharing do not establish informed consent for that processing.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The remote-parsing workflow lacks a privacy warning about third-party processing of résumé data.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

The workflow directs remote documents through a parsing channel without explicitly warning that an external provider may receive résumé data or sensitive URLs. Broad statements that the skill does not upload or send requests can obscure the delegated service's data transfer.

Content

No source excerpt is available for this finding.

Adding [待人工] bypasses the manifest's prohibition on hiring and ranking assertions.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

Any line containing [待人工] is skipped before either hiring or ranking check, so an explicit recommendation can pass merely by appending that marker. Although the exception is documented, it does not verify human review and undermines the advertised zero-assertion safeguard for employment-related material.

Content

No source excerpt is available for this finding.

The success output certifies verbatim source verification even when source documents were not supplied.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

When source documents are omitted, quotation checks are recorded as unverifiable, yet the checker returns success and prints that both quotations were verified against the originals. The unresolved-item count provides a caveat but does not correct the false certification, allowing fabricated evidence to appear validated to users or automation.

Content

No source excerpt is available for this finding.

Tainted flow: 'body' from pathlib.Path.read_text (line 108, file read) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/collect_fit.py (reported line 114)May include surrounding context.

python

p = Path(a.out)
        try:
            p.parent.mkdir(parents=True, exist_ok=True)
            p.write_text(body, encoding='utf-8')
        except OSError as e:
            print('取值域故障：写不到 %s（%s）' % (p, e.strerror or '原因未取到'))
            return 3