ClawHub
Back to skill

Security audit

AI 简历纠错排版大师

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to locally audit and format resume text as advertised, with dependency hygiene concerns but no evidence of hidden data access or exfiltration.

Install only if you are comfortable providing resume content to the agent environment. Use the anonymized mode before sharing generated resumes publicly, and prefer pinning or reviewing the Python dependencies before using the skill in a production or shared environment.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Unpinned Dependencies

Low
Category
Supply Chain
Content
python-docx
pdfplumber
Confidence
97% confidence
Finding
The dependency is unpinned, so installs may resolve to different versions over time, including newly introduced vulnerable or breaking releases. This weakens supply-chain integrity and reproducibility, making it harder to audit and safely deploy the skill.

Unpinned Dependencies

Low
Category
Supply Chain
Content
python-docx
pdfplumber
Confidence
97% confidence
Finding
The dependency is unpinned, so package resolution can drift across environments and time, potentially pulling in vulnerable or incompatible releases. This creates a preventable software supply-chain risk even if the package itself is currently trusted.

Known Vulnerable Dependency: python-docx — 2 advisory(ies): CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)

High
Category
Supply Chain
Confidence
99% confidence
Finding
python-docx is flagged with a known XXE-related vulnerability (CVE-2016-5851) affecting versions before 0.8.6. If the skill processes attacker-controlled DOCX files, XXE can allow unintended file disclosure, server-side request forgery, or other XML parser abuse, making this especially relevant in a document-processing context.

Static analysis

No suspicious patterns detected.