Security audit

resume-interview-coach

Security checks for vulnerabilities and agentic risk

Overview

This resume and interview coaching skill has useful coaching features, but it also adds automatic persistent learning and self-modification behavior that is not clearly scoped or user-controlled.

Review before installing. The core resume and interview coaching behavior is understandable, but install only if you are comfortable with the skill automatically writing local memory files and potentially modifying its own SKILL.md. Avoid sharing sensitive resume, employer, compensation, or interview details unless persistence is removed or made explicit, opt-in, reviewable, and deletable.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a resume and interview coach, but the instructions add a generic self-learning subsystem that persists usage history, errors, and user preferences across sessions. This expands behavior beyond the declared coaching purpose and can cause undisclosed collection and retention of personal data from highly sensitive career-related interactions.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The documentation introduces a self-evolving learning system that stores operation counts, error patterns, preferences, and improvement notes in a persistent file. In a resume/interview context, that can capture sensitive personal and professional information without clear necessity, notice, or retention controls.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: A generic learner module that records cross-session preferences and error history is not clearly justified by the stated skill purpose. Because this skill handles resumes, interview responses, salary expectations, and employer targets, persisted history can accumulate sensitive profile data and create privacy and data leakage risk.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill instructs the agent to invoke a Bash/Python script after each use, introducing code-execution and file-mutation behavior unrelated to the core coaching task. This increases attack surface by normalizing auxiliary script execution and creating a path for unintended writes or abuse if the script or inputs are manipulated.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The module is explicitly designed as a generic cross-skill learner that records usage history, errors, notes, and user preferences for any skill, which exceeds the stated purpose of a resume/interview coaching skill. In this context, that creates unnecessary collection and retention of behavioral data that may include sensitive job-search information, increasing privacy risk and broadening the skill’s effective scope without clear user consent.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The code persists learned patterns, recent operations, error notes, and arbitrary user preferences to learned_patterns.json on disk, despite the skill description only advertising coaching functions. Because notes and preferences are free-form, the file can accumulate sensitive personal or employment-related data and leave it stored locally without access controls, encryption, or disclosure.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill describes persistent storage of user preferences and usage patterns but does not present a clear warning to users. In this context, the omitted disclosure is dangerous because job-search sessions often include personal identifiers, employment history, compensation expectations, and other sensitive information that users may not expect to be retained.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The instructions say important user preferences should be written and automatically reused later, including output language, without renewed confirmation. Silent reuse of stored preferences across sessions can violate user expectations, leak prior-session context, and demonstrate that the system is retaining profile data without fresh consent.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Persistent retention of usage history, errors, notes, and preferences in natural language creates a realistic data leakage path. In a resume/interview coaching skill, these records may contain names, employers, interview failures, compensation goals, and other sensitive career data that could be exposed through later reads, logs, or unintended reuse.

Static analysis

No suspicious patterns detected.