Security audit

Ai Job Advisor

Security checks for vulnerabilities and agentic risk

Overview

This job-advisor skill is coherent, but it needs review because it automatically saves sensitive job-search details and can read prior local records without clear permission.

Install only if you are comfortable with automatic local job-search records. Before use, disable or modify auto-save behavior, avoid uploading unredacted screenshots of chats or offers, do not allow the skill to read old Downloads records unless you explicitly choose the file, and consider removing remote scripts and hardcoded branding from generated resumes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Note

Location: resume-template.html:129
Finding: Unconditional Third-Party Branding in Generated Resumes
Content: View full analysis
Powered by Claude Code CLI & KIMI API ``` The corresponding Skill documentation describes this attribution as optional: ```markdown - Optional footer attribution identifying Claude Code CLI and KIMI API ``` ### Technical Analysis The resume template unconditionally embeds third-party promotional branding in every generated document. Although the Skill documentation characterizes the footer as optional, the template does not contain a condition, configuration flag, or consent mechanism that allows users to disable it. This creates an output-integrity issue: the Skill adds content unrelated to the user's professional qualifications and may cause users to distribute promotional material without realizing it is mandatory in the generated template. ### Attack Path 1. A user asks the Skill to generate a resume. 2. The Skill populates `resume-template.html`. 3. The hardcoded footer is included without requesting user consent. 4. The user exports or distributes the resume. 5. The resulting document promotes third-party products regardless of the user's preference. ### Impact Assessment No system privileges are obtained. The affected scope is the integrity and presentation of every resume generated from this template. Users may unknowingly disclose their use of AI-assisted tooling or distribute unwanted branding in professional documents. ]]>
Remediation: View remediation
Powered by the selected resume-generation tools {{/if}} ``` - Default `showAttribution` to `false`. - Preview all generated content to the user before saving or exporting it. - Ensure the documentation accurately reflects whether the attribution is optional. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:364
Finding: Automatic Persistent Storage of Sensitive Job-Search Information Without Explicit Consent
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:404
Finding: Implicit Access to Historical Records Outside the Project Directory
Content: View full analysis
/Downloads/# 求职进展记录` may be referenced to complete it. ``` ### Technical Analysis The Skill authorizes the agent to inspect a location under the user's Downloads directory when a company name is missing. This path is outside the project directory and may contain unrelated, outdated, or sensitive records. The instruction does not require the agent to ask for permission before reading the external path. It also does not define strict filename matching, file-type restrictions, validation requirements, or safeguards against incorporating information belonging to another person. Using external historical records to infer missing information also creates an integrity risk: stale or ambiguous records may be associated with the wrong job application. ### Attack Path 1. The user discusses an application without explicitly naming the company. 2. The Skill detects that the company field is missing. 3. The agent accesses the specified location under the Downloads directory. 4. Historical records are read without path-specific approval. 5. Information from those records is inserted into the current output or persistent memory. 6. Unrelated, stale, or private content may consequently be disclosed or misattributed. ### Impact Assessment The agent obtains read access beyond the project directory for a purpose that is not essential to the current request. The affected scope includes any readable records selected from the referenced Downloads location. This does not ...[truncated 188 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: resume-template.html:6
Finding: Execution of Mutable Remote JavaScript in Generated Resume Documents
Content: View full analysis
``` The template also performs an external font request: ```html ``` ### Technical Analysis Every time the generated HTML resume is opened with network access, the browser downloads and executes JavaScript from `cdn.tailwindcss.com`. The dependency is not version-pinned, locally vendored, or protected by Subresource Integrity. Consequently, the effective JavaScript payload can change after the Skill package has been audited. A compromise of the CDN, DNS resolution path, upstream deployment process, or serving account could cause arbitrary JavaScript to execute in the resume's document context. The Google Fonts reference is not executable JavaScript, but it creates an additional external request that exposes network metadata such as the viewer's IP address, user agent, and access time. ### Attack Path 1. The Skill generates an HTML resume containing the external script reference. 2. The user or a recruiter opens the document in a browser while online. 3. The browser requests the current JavaScript payload from the CDN. 4. If the remote source or delivery path has been compromised, malicious JavaScript is returned. 5. The browser executes the malicious payload in the document context. 6. The payload may alter resume content, display phishing material, initiate further network requests, or attempt browser-based exploitation. ### Impact Assessment The remote script executes with the privileges available to JavaScript in the browser document. It does not automatically receive operating-system administrator privileges, but it can control the rendered resu ...[truncated 245 chars]
Remediation: View remediation
``` - Verify that the generated resume renders correctly with networking disabled. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: resume-template.html:39
Finding: Insufficiently Defined Escaping for User-Controlled HTML Template Fields
Content: View full analysis

{{姓名}}
微信号：{{微信号}}

求职意向：{{求职意向}}

{{性别}} | {{年龄}}岁| {{电话}}| {{邮箱}}| ``` The avatar URL is inserted into an HTML attribute: ```html ``` Custom content is also placed directly into an HTML body context: ```html {{#each 自定义补充}}

{{标题}}

{{内容}}

{{/each}} ``` ### Technical Analysis The template contains numerous placeholders populated from resumes, imported files, screenshots, job descriptions, and user-provided custom sections. The project does not specify which rendering engine performs substitution or require context-aware output encoding. If the generator performs direct string replacement or uses an unsafe rendering mode, attacker-controlled values can terminate the intended text or attribute context and inject HTML. Attribute fields such as the avatar URL require stricter validation than ordinary text ...[truncated 1585 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly stores complete job descriptions, salary ranges, locations, channels, and application history in persistent memory files, and even permits filling gaps from historical local records. This creates a rich, durable dossier of the user's professional activity and preferences, and the inferred completion from local files further increases the chance of collecting more data than the user intended to share.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises automatic memory archiving of conversation details into local files without a clear upfront privacy notice or explicit consent flow. Because job-search discussions commonly include employer names, salary targets, contact details, and candid assessments, automatic persistence can expose sensitive personal and professional information unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill requests highly sensitive resume inputs, including phone number, email, WeChat ID, salary expectations, city, and photo, and pairs them with local record generation. Collecting this amount of personal data without a clear privacy disclosure, minimization policy, or storage warning increases the risk of over-collection and unintended retention.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill mandates immediate automatic updates to local memory files after new job descriptions or progress details are provided, without waiting for a save command. This removes meaningful user control over storage and can persist sensitive job-search activity, timelines, and employer interactions without informed consent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is designed for automatic long-term retention of user job-search information whenever certain events occur, rather than requiring explicit save actions. Persistent storage of application status, employer names, salary expectations, and related notes increases exposure if local files are accessed by other users, synced unexpectedly, or mishandled.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill mandates extraction and storage of conversation details into persistent records based on trigger phrases and new progress updates. That behavior can cause users to disclose information conversationally without realizing it will be converted into durable records, increasing privacy and surveillance-like risks.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs reading from a specific local filesystem path to infer missing company names from prior records. That expands access beyond data the user provided in the current interaction and can cause unauthorized collection of sensitive application history from local files. In a job-advising skill, this is not necessary for core functionality and creates a clear data boundary violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The fortune feature requests birth date and gender, which are sensitive personal attributes, but does not present a clear privacy warning or explain retention and use. Since this information is unrelated to core job-advising needs, collecting it without strong disclosure increases unnecessary privacy risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The instruction to prefer screenshots of resumes, chats, interview feedback, and offers encourages collection of dense, highly sensitive documents that often contain names, compensation, contact information, and employer communications. In combination with the skill's persistence features, this materially increases the volume and sensitivity of stored personal data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTML document declares lang="zh-CN", which hard-codes a specific language/locale for the output. Under the policy, forcing a specific locale without user opt-in or clear justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill description and all user-facing instructions are presented exclusively in Chinese, with no indication that users may choose another language. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy issue unless the locale restriction is documented and justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

{{姓名}}

{{标题}}

SkillSpector

Ssd 3

Missing User Warnings

Missing User Warnings

Missing User Warnings

Ssd 3

Ssd 3

Context-Inappropriate Capability

Missing User Warnings

Ssd 3

Natural-Language Policy Violations

Natural-Language Policy Violations

Static analysis