Security audit

Reactive Resume

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Reactive Resume development guide, but its included database reset and deployment examples contain high-impact unsafe patterns that users should review before use.

Install only if you are comfortable reviewing and controlling the setup steps. Do not run scripts/db-reset.py against any database that is not disposable, do not let untrusted values control DATABASE_URL, replace all example secrets and tokens, avoid exposing Browserless or databases publicly, and treat Docker socket, sudo, cron, and restore examples as high-impact operations requiring explicit user approval.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (7)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/db-reset.py:33
Finding: Shell Command Injection Through DATABASE_URL
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/db-reset.py:73
Finding: Predictable Temporary SQL File Enables Symlink and Race Attacks
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/db-reset.py:63
Finding: Production Database Safeguard Is Bypassable and Connection Credentials Are Printed
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/create-template.py:112
Finding: Template Name Path Traversal and Unconditional File Overwrite
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/api-reference.md:296
Finding: File Upload Example Omits Resource Authorization and File Security Controls
Content: View full analysis
{ const buffer = await input.file.arrayBuffer(); const key = `resumes/${ctx.user.id}/${input.resumeId}/${input.file.name}`; await s3Client.send(new PutObjectCommand({ Bucket: process.env.STORAGE_BUCKET, Key: key, Body: Buffer.from(buffer), ContentType: input.file.type, })); return { url: `https://${process.env.STORAGE_BUCKET}/${key}` }; }); ``` ### Technical Analysis `protectedProcedure` verifies that the caller is authenticated, but the example never loads the identified resume or verifies that `input.resumeId` belongs to `ctx.user.id`. Authentication alone does not provide object-level authorization. The entire file is buffered before any documented size check. The implementation also trusts the client-provided filename and MIME type, does not restrict extensions or content, and returns a directly constructed URL. Client filenames can contain path separators or special characters that produce confusing object keys. If uploaded objects are publicly served, active content may be delivered from application-controlled storage. ### Attack Path 1. An authenticated attacker obtains or guesses another user's resume identifier. 2. The attacker invokes the upload mutation with that identifier. 3. The procedure accepts the request because it checks only that the caller is logged in. 4. The attacker supplies an oversized file, misleading MIME type, dangerous active content, or crafted filename. 5. The server loads the entire file into memory and stores it without ownership or conte ...[truncated 705 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/api-reference.md:346
Finding: PDF Export Example Allows Rendering Without Resume Ownership Verification
Content: View full analysis
{ const resumeUrl = `${process.env.APP_URL}/resume/${input.resumeId}`; const pdfBuffer = await generatePdf(resumeUrl); // 上传到存储或返回 return { pdf: pdfBuffer.toString('base64'), contentType: 'application/pdf', }; }); ``` ### Technical Analysis The endpoint requires an authenticated caller but directly embeds the supplied `resumeId` into a render URL. It does not query the resume, verify ownership, or evaluate an explicit sharing policy before instructing the printer service to load the page. This is an insecure direct object reference pattern. If the printer can access the resume route with greater trust than the requesting user, or if the route exposes resumes by identifier, the export endpoint becomes a proxy for unauthorized content retrieval. ### Attack Path 1. An authenticated attacker obtains or guesses another user's resume identifier. 2. The attacker submits the identifier to the PDF export mutation. 3. The procedure constructs the target URL without checking ownership. 4. The Browserless/Puppeteer service loads the target resume. 5. The generated PDF is returned as Base64 to the attacker. 6. The attacker decodes the response and obtains the victim's resume data. ### Impact Assessment Successful exploitation can disclose complete resume contents, potentially including names, addresses, phone numbers, email addresses, employment history, education, and other personal information. Access is limited to resumes reachable by the rendering route and printer context, but may affect any user whose resume identifier becomes known. ]]>
Remediation: View remediation
and(eq(resumes.id, input.resumeId), eq(resumes.userId, ctx.user.id)), }); if (!resume) { throw new TRPCError({ code: "NOT_FOUND" }); } ``` - If public sharing is supported, evaluate an explicit and revocable share policy rather than assuming possession of an ID grants access. - Use UUID validation or another strict identifier schema. - Ensure the printer accesses a dedicated internal render route protected by a short-lived, resume-scoped token. - Do not give the printer a broad session or credential capable of reading arbitrary user records. - Record export events and rate-limit PDF generation to reduce enumeration and resource abuse. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: references/deployment.md:12
Finding: Deployment Examples Use Predictable Secrets and Mutable Container Tags
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (31)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
4. 配置环境变量

bash
cp .env.example .env

关键配置：

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/deployment.md (reported line 149)May include surrounding context.
4. 配置环境变量

bash
cp .env.example .env

关键配置：

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/db-reset.py (reported line 51)May include surrounding context.
python
### 4. 配置环境变量 ```bash cp .env.example .env ``` **关键配置**：

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/db-reset.py (reported line 60)May include surrounding context.
python
### 4. 配置环境变量 ```bash cp .env.example .env ``` **关键配置**：

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/deployment.md (reported line 148)May include surrounding context.
md
pnpm install # 配置环境变量 cp .env.example .env # 编辑 .env # 构建

Docker Socket Access

High

Category: Privilege Escalation
Confidence: 98% confidence
Finding: Mounting /var/run/docker.sock into a container gives that container effective control over the Docker daemon, which commonly enables container breakout, access to other containers, host filesystem mounting, and root-level host compromise. In this deployment guide the intent is legitimate Traefik service discovery, but the capability is still highly dangerous if Traefik or any code execution path in that container is compromised.
Content: Scanner excerpt · references/deployment.md (reported line 282)May include surrounding context.
md
- "80:80" - "443:443" volumes: - /var/run/docker.sock:/var/run/docker.sock - ./letsencrypt:/letsencrypt app:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: Using subprocess.run with shell=True on a command string creates a direct parameter-abuse path. In this script, the psql command is built with an environment/.env-derived DATABASE_URL, so a crafted value containing shell separators could execute arbitrary OS commands under the privileges of the user running the reset tool.
Content: Scanner excerpt · scripts/db-reset.py (reported line 38)May include surrounding context.
python
"""运行 shell 命令""" try: if capture: result = subprocess.run(command, shell=True, capture_output=True, text=True) return result.returncode, result.stdout, result.stderr else: subprocess.run(command, shell=True)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: This second shell=True usage keeps the same unsafe API available across the script. While present calls may currently be constant strings, the helper normalizes insecure command execution and makes future or indirect parameter abuse likely.
Content: Scanner excerpt · scripts/db-reset.py (reported line 41)May include surrounding context.
python
result = subprocess.run(command, shell=True, capture_output=True, text=True) return result.returncode, result.stdout, result.stderr else: subprocess.run(command, shell=True) return 0, "", "" except Exception as e: print_colored(f"Error: {e}", Colors.RED)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/db-reset.py (reported line 52)May include surrounding context.
python
db_url = os.environ.get('DATABASE_URL') if not db_url: # 尝试从 .env 读取 if os.path.exists('.env'): with open('.env', 'r') as f: for line in f: if line.startswith('DATABASE_URL='):

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/db-reset.py (reported line 53)May include surrounding context.
python
db_url = os.environ.get('DATABASE_URL') if not db_url: # 尝试从 .env 读取 if os.path.exists('.env'): with open('.env', 'r') as f: for line in f: if line.startswith('DATABASE_URL='):

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill clearly instructs the agent/user to perform shell actions, read/write files, and manipulate environment configuration, but it declares no explicit tool scope or permissions. That creates an overbroad execution surface where an agent could invoke capabilities beyond what the skill contract communicates, increasing the chance of unsafe or unintended system changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This section tells the operator to start Docker services and even launch dockerd with sudo, but it provides no warning that these commands make system-level changes, create background services, and may require elevated privileges. In an agent context, omitting that warning makes accidental privileged execution more likely and reduces informed consent for impactful operations.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The instruction to run sudo dockerd launches the Docker daemon with root privileges, which is a high-impact system action and expands the attack surface if executed by an agent or unsuspecting user. Because Docker effectively grants root-equivalent control over the host, normalizing this command without safeguards is dangerous.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
bash
# 启动 PostgreSQL 和 Browserless（PDF 导出必需） sudo dockerd &>/var/log/dockerd.log & sudo docker compose -f compose.dev.yml up -d postgres browserless

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 91% confidence
Finding: Running sudo docker compose ... up starts containers with elevated control over host resources and can change networking, volumes, and local services. In a skill document, presenting privileged commands as routine setup steps without guardrails increases the risk of unintended host modification.
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
bash
# 启动 PostgreSQL 和 Browserless（PDF 导出必需） sudo dockerd &>/var/log/dockerd.log & sudo docker compose -f compose.dev.yml up -d postgres browserless

4. 配置环境变量

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
# Printer (Browserless for PDF) # 获取 Docker bridge IP: # sudo docker network inspect reactive_resume_default --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}' PRINTER_APP_URL=http://<GATEWAY_IP>:3000 PRINTER_ENDPOINT=ws://<GATEWAY_IP>:4000?token=1234567890

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.
md
# Printer (Browserless for PDF) # 获取 Docker bridge IP: # sudo docker network inspect reactive_resume_default --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}' PRINTER_APP_URL=http://<GATEWAY_IP>:3000 PRINTER_ENDPOINT=ws://<GATEWAY_IP>:4000?token=1234567890

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/deployment.md (reported line 258)May include surrounding context.
md
# Printer (Browserless for PDF) # 获取 Docker bridge IP: # sudo docker network inspect reactive_resume_default --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}' PRINTER_APP_URL=http://<GATEWAY_IP>:3000 PRINTER_ENDPOINT=ws://<GATEWAY_IP>:4000?token=1234567890

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The self-hosting example includes concrete database credentials and a fixed Browserless token without an explicit warning that these are placeholders only. Users may copy them directly into real deployments, leading to weak default credentials, exposed services, and trivial unauthorized access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code hard-codes multiple user-visible section labels in English (for example, "Summary", "Work Experience", "Projects", "Education", "Skills") while the surrounding file comments and metadata are in Chinese. That creates a locale policy concern because the rendered output forces one language for end users without any opt-in or configuration path.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file uses Chinese throughout, including the title and all instructional content, but does not indicate that the language is optional or that the skill is intended only for a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/deployment.md (reported line 255)May include surrounding context.
bash
# 安装 certbot sudo apt install certbot python3-certbot-nginx # 获取证书 sudo certbot --nginx -d resume.yourdomain.com

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/deployment.md (reported line 261)May include surrounding context.
bash
# 安装 certbot sudo apt install certbot python3-certbot-nginx # 获取证书 sudo certbot --nginx -d resume.yourdomain.com

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/templates-guide.md (reported line 276)May include surrounding context.
bash
# 安装 certbot sudo apt install certbot python3-certbot-nginx # 获取证书 sudo certbot --nginx -d resume.yourdomain.com

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file includes commands that can overwrite database contents during restore and permanently delete old backup files, but the surrounding text does not warn users about data loss or irreversible effects. For markdown files, safety-impacting behaviors that affect user data should be disclosed clearly.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

SkillSpector

Credential Access

4. 配置环境变量

Credential Access

4. 配置环境变量

Credential Access

Credential Access

Credential Access

Docker Socket Access

Tool Parameter Abuse

Tool Parameter Abuse

Credential Access

Credential Access

Undeclared Tool Scope

Missing User Warnings

Sudo/Root Execution

Sudo/Root Execution

4. 配置环境变量

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Rp1

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Missing User Warnings