Security audit
Security checks for vulnerabilities and agentic risk
This resume-building skill appears purpose-aligned, but it sends highly personal resume data to an external service without clear privacy, retention, or download-safety disclosures.
Review this before installing if you will process real candidate or employee resumes. Treat all submitted resume and cover-letter fields as potentially sent to ToolWeb's external API, and avoid using confidential or regulated personal data unless the publisher provides acceptable privacy, retention, deletion, and security terms.
The skill processes highly sensitive resume data including full names, email addresses, phone numbers, employment history, education, and potentially original resume text, but the description provides no privacy, retention, or handling warning. Users may upload personal data without understanding that it is being transmitted to a third-party service, increasing privacy and compliance risk.
The skill references and relies on an external API endpoint, meaning user-provided resume data is transmitted outside the local trust boundary to api.toolweb.in. In the context of resume generation and parsing, this external transmission includes sensitive PII and career-history data, making the absence of clear trust, privacy, and security disclosures materially risky.
## References
- Kong Route: https://api.toolweb.in/tools/resumy
- API Docs: https://api.toolweb.in:8166/docs
The /generate endpoint handles highly sensitive personal and professional data including full name, email, phone, employment history, education, and original resume text, but the spec contains no notice of privacy handling, retention, or user-consent expectations. This increases the risk of over-collection, unintended disclosure, or unsafe downstream use because integrators and users are not warned that they are submitting substantial PII.
This is a manifest/config file, so vague-trigger review applies. The /parse-resume endpoint is described only as Parse Resume Endpoint and accepts an arbitrary object (additionalProperties: true), but the spec provides no narrowing context, expected invocation conditions, or exclusion criteria to clarify when this capability should be used versus ignored.
The manifest advertises a /download/{filename} endpoint, which implies generated user documents can be retrieved, but there is no descriptive warning about what files are downloadable, whether they contain sensitive personal information, or how users should verify the requested file. For manifest/description review, that omission is a missing user warning because the behavior affects user data handling.
No suspicious patterns detected.