ClawHub
Back to skill

Security audit

Resume Builder

Security checks for vulnerabilities and agentic risk

Overview

This resume-builder skill stores sensitive resume information locally, but that behavior is disclosed, scoped to its resume purpose, and shows no network exfiltration or hidden destructive behavior.

Install only if you are comfortable keeping resume and cover-letter data in ~/.openclaw/resume-builder/. Consider reviewing or deleting those local files when finished, and be aware that broad phrases like "summary" may invoke resume-related behavior.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The top-level description includes the catch-all trigger phrase or any resume/CV task, which is overly broad and can cause the skill to activate on loosely related conversation. Overbroad activation increases the chance of unintended access to highly sensitive personal data such as employment history, contact details, and cover-letter content, especially in contexts where the user did not explicitly request this skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

This skill persistently stores extensive personally identifiable information in local files under ~/.openclaw/resume-builder/, including contact details, employment history, education, and cover letters. Even without network exfiltration, session persistence of sensitive career data expands the privacy risk surface because other local processes, users, backups, or later unintended skill invocations may access or expose the data.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: resume-builder
description: When user asks to create a resume, build CV, update resume, generate cover letter, optimize resume for ATS, tailor resume for a job, format resume, add work experience, add skills, add education, create professional summary, export resume, review resume, or any resume/CV task. 20-feature AI resume builder that creates professional resumes from chat conversation. Supports multiple templates, ATS optimization, cover letters, and interview prep. All data stays local — NO external API calls, NO network requests, NO data sent to any server.
metadata: {"clawdbot":{"emoji":"📄","requires":{"tools":["read","write"]}}}
---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation guidance includes generic triggers such as summary and professional summary, which can collide with normal conversation unrelated to resumes. This can lead to unintended invocation and unnecessary collection or persistence of personal information into local profile storage without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The command list advertises generic triggers like help and resume in [language], and the broader command set reinforces ambiguous invocation patterns. Generic commands can collide with unrelated user requests, causing the skill to activate unexpectedly and operate on stored resume data or begin collecting sensitive information.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation explicitly states that an exec capability is needed to run mkdir -p ~/.openclaw/resume-builder, but the manifest metadata only declares read and write tools. This is a direct contradiction between the skill's own documentation about how it operates and the capabilities it declares.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.