OfferClaw留学申请简历助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:57 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its admissions CV purpose, but its default PDF export adds an unapproved OfferClaw footer and installs unpinned packages at runtime.

Review this skill before installing if PDF export matters to you. Use '--watermark off' or avoid the exporter unless you accept the OfferClaw footer, and prefer pinned, reviewed dependencies or a sandboxed export environment because CV contents can include sensitive personal and academic details.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/export-pdf/export_pdf.py:126

Finding

Undisclosed Promotional Content Injection into Exported PDFs

Content

View full analysis

Powered by OfferClaw' ``` ```python def build_overlay( template_values: dict[str, str], watermark_mode: str ) -> tuple[str, str]: if watermark_mode == "off": return "", "" return render_template(OVERLAY_CSS_TEMPLATE, template_values), OVERLAY_HTML ``` ```python parser.add_argument( "--watermark", choices=WATERMARK_CHOICES, default="on", help="Watermark mode: on includes the OfferClaw footer, off omits it.", ) ``` The behavior conflicts with the following workflow requirement in `SKILL.md`: ```markdown - The tagged version is for rendering only — it must not alter, add, or remove any content from the confirmed English text. ``` ### Technical Analysis The PDF exporter enables a fixed third-party promotional footer by default. The standard export command documented by the Skill does not pass `--watermark off`, so the generated PDF contains content that was not part of the user-confirmed CV. This is an output-integrity violation: the rendering stage modifies the final document even though the Skill explicitly requires the tagged rendering version not to add, remove, or alter confirmed content. The existing content consistency check can also fail to detect this behavior because the footer is injected by the exporter after the Markdown file is generated and checked. Although the command-line interface provides an opt-out, the default b ...[truncated 1384 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/export-pdf/requirements.txt:1

Finding

Automatic Installation of Unpinned Third-Party Dependencies

Content

View full analysis

None: if VENV_PYTHON.exists(): return print("Initializing export environment...", file=sys.stderr) try: venv.EnvBuilder(with_pip=True).create(VENV_DIR) except Exception as exc: # pragma: no cover - surfaces platform setup issues clearly raise RuntimeError( "Failed to create the PDF export virtual environment. " "Make sure Python 3 venv support is installed." ) from exc subprocess.check_call( [ str(VENV_PYTHON), "-m", "pip", "install", "--disable-pip-version-check", "--requirement", str(REQUIREMENTS_FILE), ], cwd=SCRIPT_DIR, ) ``` ### Technical Analysis The entry point automatically creates a virtual environment and installs `weasyprint` and `markdown` without exact version constraints or package hashes. Dependency resolution therefore depends on the packages and versions available from the active pip configuration at execution time. The installation does not use `--require-hashes`, a lock file, or an explicitly trusted package index. Consequently, the reviewed source tree does not uniquely determine the code that will be downloaded and executed. A compromised upstream release, compromised configured package index, malicious mirror, dependency substitution, or unsafe future release could enter the environment without any change to this project. The use of an isolated virtual environment reduces global package modification but does not provide a s ...[truncated 1604 chars]

Remediation

View remediation

markdown== ``` 2. Generate a fully resolved lock file that includes all transitive dependencies. 3. Record cryptographic hashes and install with: ```bash pip install --require-hashes --requirement requirements.txt ``` 4. Configure an explicit trusted package index or an internally controlled artifact repository rather than inheriting an arbitrary user-level pip configuration. 5. Download, verify, and cache approved wheels in advance; avoid source distributions where practical. 6. Separate dependency provisioning from routine PDF export and obtain explicit approval before initiating network downloads. 7. Run export in a sandbox with restricted filesystem and network access, especially when processing sensitive CV data. 8. Add automated dependency vulnerability and integrity scanning to the release process. 9. Periodically update pinned versions through a controlled review process rather than allowing runtime resolution to select new releases automatically. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (13)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/export-pdf/run.py (reported line 49)May include surrounding context.

python

def main() -> None:
    ensure_environment()
    os.execv(
        str(VENV_PYTHON),
        [str(VENV_PYTHON), str(EXPORT_SCRIPT), *sys.argv[1:]],
    )

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to read local reference files and execute a shell command for PDF export, but it declares no explicit tool scope or permissions. That creates an authorization gap where an agent may use broader file and shell capabilities than reviewers or users expect, increasing the chance of unintended file access or command execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow states that conversation should use the user's language, but the actual CV output must remain in English unless the user explicitly asks otherwise. This imposes a language choice by default rather than offering a neutral user choice or requiring opt-in, which matches the locale/language policy violation criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill permits internet-dependent dependency installation at runtime to support PDF export, which expands the attack surface beyond simple CV drafting into network retrieval and package execution. If abused or if dependencies are tampered with, this can lead to supply-chain risk, unexpected code execution, or data exposure from an environment handling user CV contents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instructions require that each bullet be given in English first, regardless of the user's preferred or working language. This is a natural-language locale policy constraint without user opt-in, and only afterward permits an explanation in the user's working language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly requires collection of personally identifiable information, including full name, phone number, email, education history, and GPA, but provides no privacy notice, data-minimization guidance, or handling restrictions. In an admissions CV-writing context this is expected operationally, but it still increases risk because users may disclose sensitive personal and academic data without being told how it will be used, retained, or protected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Line L009 explicitly requires the CV to be produced in English. This is a natural-language locale policy issue because the file does not provide user opt-in, an alternative language option, or a documented reason why English is mandatory.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/export-pdf/run.py (reported line 33)May include surrounding context.

python

"Make sure Python 3 venv support is installed."
        ) from exc

    subprocess.check_call(
        [
            str(VENV_PYTHON),
            "-m",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script automatically creates a virtual environment and installs dependencies on first run without explicit user confirmation or prior trust validation. In an agent skill context, this increases supply-chain risk because simply invoking PDF export can trigger network package retrieval and code execution from whatever is pinned in requirements.txt or resolved by pip.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency 'weasyprint' is unpinned, so installs may resolve to different versions over time, including versions with known security defects. In this skill, WeasyPrint is used for PDF export, which increases risk because historical advisories include SSRF and arbitrary file/URL attachment issues that can be reachable when converting user-controlled content to PDF.

Content

Scanner excerpt · scripts/export-pdf/requirements.txt (reported line 1)May include surrounding context.

text

weasyprint
markdown

Unverifiable Dependency: weasyprint has 8 known advisory(ies) (CVE-2024-28184 (WeasyPrint allows the attachment of arbitrary files and URLs to a PDF); CVE-2025-68616 (WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP R); CVE-2026-55073 (weasyprint Has Server-Side Request Forgery (SSRF)) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

This is a true supply-chain risk because WeasyPrint has multiple known advisories, including SSRF-related issues, and the manifest does not specify which version will be installed. Given this skill exports PDFs and may render user-influenced content, an affected WeasyPrint release could let crafted input trigger network access or embed unintended local/remote resources during rendering.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency 'markdown' is also unpinned, making builds non-reproducible and allowing accidental installation of vulnerable or incompatible releases. Although Markdown is lower risk than the PDF renderer here, it may still process user-supplied CV content and malformed input could trigger parser flaws or denial-of-service conditions in affected versions.

Content

Scanner excerpt · scripts/export-pdf/requirements.txt (reported line 2)May include surrounding context.

text

weasyprint
markdown

Unverifiable Dependency: markdown has 2 known advisory(ies) (CVE-2025-69534 (Python-Markdown has an Uncaught Exception); CVE-2025-69534 (Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like se)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The markdown dependency has known advisories, but because no version is pinned, the deployed package could be a vulnerable release without visibility. In this admissions CV-writing context, markdown likely handles untrusted user text before PDF generation, so parser crashes or malformed-input handling bugs could affect service availability or processing reliability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.