Back to skill

Security audit

resume-evaluation-report

Security checks for vulnerabilities and agentic risk

Overview

This is a resume-review prompt skill with no bundled code or hidden data movement, though it should only be used for explicit recruiting or candidate-evaluation contexts.

Install this only if you want HR-style resume and candidate evaluation. Use it with explicit recruiting context and candidate-provided resume materials, and treat its pass or no-pass recommendations as decision support that needs human review, not as an automated hiring decision.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are broad enough to match ordinary conversation about a person, not just explicit resume-review or hiring workflows. That can cause unintended invocation on sensitive personal content, leading the agent to generate employment-style profiling or risk judgments without clear user intent or appropriate context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation logic permits analysis of 'a candidate' without clearly requiring an actual resume or explicit employment decision context. This increases the chance the skill is used to infer sensitive judgments about a person from minimal or ambiguous information, which can result in privacy-invasive profiling or inappropriate hiring-style assessments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.