ClawHub
Back to skill

Security audit

Digital Identity, CV & Resume Creator

Security checks across malware telemetry and agentic risk

Overview

This is a transparent CV-publishing helper, but it sends resume details to Talent.de and can create a lasting online CV link.

Install only if you are comfortable sending provided resume details to Talent.de and creating a persistent online CV. Keep human review enabled for normal use, avoid government IDs, passwords, financial details, and confidential business information, and treat claim tokens and TALENT_ACCESS_ID like secrets.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The manifest description uses very broad activation language such as 'build, create, or generate a resume, CV, or set up an online professional profile,' which can cause an agent to invoke this skill in many loosely related contexts. Over-broad routing increases the chance that unrelated personal data is sent to a third-party CV service, creating privacy and unintended external-action risk even if the API itself is legitimate.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The document provides a concrete example for sending highly sensitive personal data such as full name, email, phone number, city, country, employment history, education, and social links to a remote API, but it does not warn about privacy implications, data retention, public URL exposure, or the need for explicit user consent. In the context of a CV-building skill that creates a permanent public profile/URL, this omission increases the risk that an agent or user will transmit personal data without understanding disclosure and persistence risks.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
This section instructs agents to send CV data and configure a callback URL, but it does not require any user-facing disclosure or consent step before transmitting personal information to a third-party service or to an agent-controlled webhook. Because CV data commonly contains sensitive personal details and callback payloads may expose workflow metadata, this can lead to privacy violations, unintended disclosure, or non-compliant data sharing in real deployments.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.