Security audit

resume-review

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but its normal workflow can expose unredacted resume details to arbitrary AI providers and uses mutable install/runtime dependencies.

Install only if you are comfortable with resume data being processed by your agent and potentially by an external LLM provider. Redact names, contact details, identifiers, company names, and school names locally before sending text to any model, review the generated JSON and PNG for leaks, and prefer pinned dependencies or an isolated environment without sensitive credentials.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: references/roast-prompt.md:1
Finding: Raw Resume Data Is Sent to Arbitrary External LLM Providers Before Anonymization
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:30
Finding: Unpinned Third-Party Dependencies Are Downloaded and Executed at Runtime
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向用户的简历测评/可视化生成能力，但提供的代码仅实现了本地文件文本抽取步骤，没有任何“毒舌测评”、内容分析、评分、或“JOJO 替身面板图”生成功能。其主要目的与声明明显不同。虽然文本提取可能是测评流程的辅助步骤，但单独看该代码块，核心行为是文件解析与输出，这属于未在描述中体现的重要能力，因此应判定为描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: All user-facing instructions, examples, and invocation language are presented only in Chinese, and the document does not state that the skill supports other languages or that Chinese is an intentional region-specific limitation. This can constitute a language/locale policy issue when a skill implicitly requires one language without user opt-in.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description of the skill emphasizes local, no-network behavior for producing the JOJO-style output, but the documented generation flow explicitly instructs users to send resume contents to '任意大模型' in step 2. That is a meaningful behavior mismatch because resume content leaves the local environment during normal use.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to run npx clawhub@latest install @padepa/resume-review, which pulls and executes remote code at install time without pinning to a specific immutable version. If the clawhub package or one of its dependencies is compromised, users could execute attacker-controlled code simply by following the installation instructions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README says users can invoke the skill by saying「测评一下我的简历」, but it does not define whether this phrase is the exact trigger, what variants are accepted, or when the skill should not activate. For a markdown skill description, this lacks scope constraints and negative examples, making unintended invocation more likely in ordinary resume-help conversations.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill instructs reading user-provided local resume files and writing derived JSON/PNG outputs, but it does not declare any explicit tool scope or permissions boundaries. In an agent environment, missing scope declarations can cause overbroad file access or unclear consent around handling sensitive PII such as resumes, contact details, and employment history.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description is entirely in Chinese and frames the skill around a specific Chinese locale context ('秋招简历毒舌测评') without indicating that users may choose another language. The policy requires flagging language or locale constraints when they are imposed without user opt-in or clearly justified region-specific scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The text says the skill is a '通用流程' that '任何 AI 助手、任何用户、任何平台都能执行', which broadens activation context without clearly constraining when this specific skill should be used. Combined with the simple examples in 'When to Use', this can overlap with ordinary requests for resume help rather than the narrower roast-and-panel use case.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill tells the agent to write resume-derived JSON to disk without a clear, prominent warning that sensitive personal and employment data may be stored locally. Because resumes contain high-value PII, saving intermediate artifacts can create unintended retention, leakage, or later access by other local processes or users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script encourages users to upload PDF or Word resumes and says the tool will anonymize personal information, but it does not warn that resumes contain sensitive personal data or explain any limits of the anonymization process. Users may overtrust the claim and submit real resumes containing names, phone numbers, emails, addresses, employment history, or other personal data to an agent or model that may transmit, log, or retain that information.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The language-style section explicitly requires a Chinese colloquial tone and provides only Chinese phrasing examples, which imposes a specific language/locale behavior. The file does not offer user opt-in or explain a justified region-specific restriction, so it creates a natural-language policy concern under the language/locale rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill’s natural-language interface is written entirely in Chinese, including usage/help text and status messages, with no indication that the language is configurable or that the tool is intended only for a Chinese-speaking context. This can violate a language/locale policy when users are not given an opt-in choice.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest describes a resume-review skill that critiques resumes and generates a JOJO-style panel image, but this script implements a general local document text extractor for multiple file types, including .json and .csv, and can write extracted content to an arbitrary output path. That extraction utility is broader than the user-facing purpose described in the manifest and exposes file-processing behavior not implied by 'resume review' alone.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code emits user-facing text in Chinese via a hard-coded error message, and similar forced-language strings appear elsewhere in the script. The file provides no user opt-in, language selection, or documented region-specific justification, which conflicts with the policy against imposing a specific language without choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This JSON template hard-codes all visible persona and verdict text in Chinese, which creates a language/locale constraint in natural-language content. The file does not indicate that the skill is region-specific or that users can choose another language, so it appears to impose a specific language without opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This wording suggests a complete workflow without AI assistance, but step 2 directly requires sending the resume text and prompt to a large model to obtain the JSON used for rendering. That is an active contradiction in the documentation about how self-contained the process really is.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.