ClawHub
Back to skill

Security audit

Resume Builder

Security checks for vulnerabilities and agentic risk

Overview

This resume-builder skill stores sensitive resume information locally, but that behavior is disclosed, scoped to its resume purpose, and shows no network exfiltration or hidden destructive behavior.

Install only if you are comfortable keeping resume and cover-letter data in ~/.openclaw/resume-builder/. Consider reviewing or deleting those local files when finished, and be aware that broad phrases like "summary" may invoke resume-related behavior.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Vague Triggers

High
Confidence
98% confidence
Finding
The top-level description includes the catch-all trigger phrase `or any resume/CV task`, which is overly broad and can cause the skill to activate on loosely related conversation. Overbroad activation increases the chance of unintended access to highly sensitive personal data such as employment history, contact details, and cover-letter content, especially in contexts where the user did not explicitly request this skill.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: resume-builder
description: When user asks to create a resume, build CV, update resume, generate cover letter, optimize resume for ATS, tailor resume for a job, format resume, add work experience, add skills, add education, create professional summary, export resume, review resume, or any resume/CV task. 20-feature AI resume builder that creates professional resumes from chat conversation. Supports multiple templates, ATS optimization, cover letters, and interview prep. All data stays local — NO external API calls, NO network requests, NO data sent to any server.
metadata: {"clawdbot":{"emoji":"📄","requires":{"tools":["read","write"]}}}
---
Confidence
91% confidence
Finding
This skill persistently stores extensive personally identifiable information in local files under `~/.openclaw/resume-builder/`, including contact details, employment history, education, and cover letters. Even without network exfiltration, session persistence of sensitive career data expands the privacy risk surface because other local processes, users, backups, or later unintended skill invocations may access or expose the data.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The activation guidance includes generic triggers such as `summary` and `professional summary`, which can collide with normal conversation unrelated to resumes. This can lead to unintended invocation and unnecessary collection or persistence of personal information into local profile storage without clear user intent.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The command list advertises generic triggers like `help` and `resume in [language]`, and the broader command set reinforces ambiguous invocation patterns. Generic commands can collide with unrelated user requests, causing the skill to activate unexpectedly and operate on stored resume data or begin collecting sensitive information.

Intent-Code Divergence

Low
Confidence
95% confidence
Finding
The documentation explicitly states that an `exec` capability is needed to run `mkdir -p ~/.openclaw/resume-builder`, but the manifest metadata only declares `read` and `write` tools. This is a direct contradiction between the skill's own documentation about how it operates and the capabilities it declares.

Static analysis

No suspicious patterns detected.