Security audit
Security checks for vulnerabilities and agentic risk
This resume-screening skill is coherent and contains no executable code, but it handles sensitive candidate data for hiring decisions without privacy, consent, or retention guidance.
Review this before installing if you will use it with real candidates. Only process resumes you are authorized to evaluate, keep extracted data to the minimum needed, avoid sharing reports outside approved recruiting channels, and apply your organization's privacy, employment, retention, and anti-discrimination policies.
The README is entirely written in Chinese and presents the skill workflow and decision rules only in that language, with no indication that users may choose another language or that the skill is limited to a Chinese-speaking context. This creates a natural-language policy concern because it effectively forces a specific language without opt-in or documented justification.
This skill explicitly instructs users to collect, parse, extract, and structure candidate resumes, which commonly contain sensitive personal data such as names, education history, work history, contact details, and other identifying information. The skill provides operational guidance for processing that data but includes no privacy notice, minimization guidance, retention limits, consent check, redaction step, or handling restrictions, increasing the risk of unnecessary exposure or improper processing in an HR context.
This markdown guidance forces a specific language/locale for users by presenting all operational screening criteria only in Chinese. Under the stated policy, language constraints should either be optional for the user or clearly documented as justified for a region-specific use case.
No suspicious patterns detected.
