Security audit

Resume Context

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent purpose, but it asks users to enable persistent command capture and sends developer-session output through LLM and Redis workflows with broad local and environment access.

Review before installing. This skill is for users who intentionally want resume to track coding-session activity, call an LLM provider, and cache briefings in Redis. Use a trusted pinned resume version, inspect the shell hook before enabling it, avoid putting secrets in shell commands, prefer TLS Redis, and do not use this with sensitive repositories unless you are comfortable with the data flow.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:3
Finding: Forced Skill Routing Overrides Normal Agent Tool Selection
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:84
Finding: Installation Procedure Adds a Persistent Shell Command-Capture Hook
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: resume-mcp.js:39
Finding: Sensitive Session Output Is Cached to Redis Without Enforced Transport Security
Content: View full analysis
process.stderr.write(`[resume-mcp] Redis error: ${err.message}\n`)); await redis.connect().catch(() => null); function cacheKey() { if (command === "notes" && !rawProjectPath) return "resume:notes:__all__"; return `resume:${command}:${projectPath.replace(/\/+$/, "")}`; } const key = cacheKey(); ``` ```js if (redis.isReady && stdout) { try { await redis.set(key, JSON.stringify({ output: stdout }), { EX: CACHE_TTL }); } catch (err) { process.stderr.write(`[resume-mcp] Cache write error: ${err.message}\n`); } } ``` The documented configuration explicitly uses a plaintext-capable Redis URI: ```json { "skills": { "entries": { "resume-context": { "enabled": true, "env": { "REDIS_URL": "redis://your-redis-url:6379" } } } } } ``` ### Technical Analysis The bridge stores the complete standard output generated by `resume show` or `resume notes` in the Redis instance selected by `REDIS_URL`. The documentation recommends Redis Cloud and provides a `redis://` example, while the implementation does not require `rediss://` or otherwise enforce TLS. Consequently, sensitive session output can be sent over an unencrypted Redis connection if the documented URI pattern is used. The cache value is stored as plain JSON and receives no application-level encryption. The cache key also embeds the resolved absolute project path: ```js return `resume:${command}:${projectPath.replace(/\/+$/, "")}`; ``` This can reveal usernames, home-directory layouts, customer or repository names, and internal project organization to Redis administrators or othe ...[truncated 1378 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:82
Finding: Unpinned Git Dependency Is Installed Before Receiving Persistent Shell Access
Content: View full analysis
Remediation: View remediation
``` ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill sends project/session context to external services via the resume tool's LLM integration and stores results in Redis, yet the description does not clearly warn users that potentially sensitive development notes may leave the local machine and be cached remotely. This creates a real confidentiality risk because source-adjacent notes, project names, and work summaries may be disclosed to third-party providers or retained in infrastructure outside the user's control.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.
md
Required to run the bridge script (`resume-mcp.js`).

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares environment-variable requirements and instructs the agent to run shell commands, but it does not define an explicit tool/permission scope. That makes the skill's execution boundaries unclear and increases the chance an agent will invoke broader filesystem or command capabilities than the user expects, especially since the skill searches the home directory and launches external programs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill searches broad locations under the user's home directory to discover projects, but the user-facing description does not clearly disclose that behavior. Hidden or under-disclosed directory enumeration can expose sensitive project names and metadata and violates the principle of informed consent for filesystem access.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill launches an external binary while passing through the full parent environment (env: { ...process.env, ... }), which can expose secrets such as API keys, tokens, cloud credentials, and unrelated configuration to the child process. In the context of a session-briefing skill, this is broader capability than necessary and becomes more dangerous because the child process runs against a user-influenced working directory, increasing the blast radius if the resume binary or its dependencies behave unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill caches the full resume output in Redis, which may contain developer notes, project briefings, or other sensitive session context, without any disclosure, consent, or scoping shown in the code. This creates a confidentiality risk because sensitive content persists beyond the immediate request and may be accessible to other components, operators, or tenants depending on Redis deployment and key isolation.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: The dependency uses a caret range ("^4.7.0"), which allows automatic installation of newer minor and patch releases instead of a single fixed version. That increases supply-chain risk because future upstream changes or a compromised published version could be pulled into the skill without explicit review; in a skill that accesses session context and Redis-backed data, unexpected dependency changes can affect confidentiality or availability.
Content: Scanner excerpt · package.json (reported line 8)May include surrounding context.
json
"type": "module", "main": "resume-mcp.js", "dependencies": { "redis": "^4.7.0" }, "engines": { "node": ">=18"

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 66% confidence
Finding: The script shells out to the external resume binary with cwd set from a user-provided path, which can trigger processing of repository-local data. Although subprocess use is described in the header comment, there is no runtime disclosure to the user that an external command will be executed against the specified directory.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.