ClawHub
Back to skill

Security audit

Resume Assistant

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent resume-assistant prompt package, but users should treat resumes as sensitive and be careful with API use and HTML export handling.

Install only if you are comfortable sharing resume and job-description content with the agent environment that runs it. Prefer explicit /resume commands for sensitive documents, redact unnecessary personal details, and ensure any API integration or HTML/PDF export path escapes user data and uses trusted endpoints.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
templates/export/resume.html:112
Finding

Unescaped User-Controlled Data in Generated HTML Resume

Content
View full analysis

{{name}}

{{email}} · {{phone}} · {{location}}
LinkedIn · Portfolio

Professional Summary

{{summary}}

Experience

{{job_title}} {{start_date}} – {{end_date}}
{{company}} {{location}}
  • {{bullet}}
    • ``` ### Technical Analysis The HTML template places resume data into HTML text nodes, an HTML attribute, and URL attributes without specifying context-aware output encoding: - `{{name}}`, `{{summary}}`, `{{company}}`, and similar fields are inserted into text contexts. - `{{template_class}}` is inserted into a quoted HTML attribute. - `{{linkedin}}` and `{{portfolio}}` are inserted into `href` attributes. Neither the template nor `prompts/export.md` requires HTML escaping, attribute escaping, URL parsing, or an allowed-scheme policy. If an integration performs direct placeholder substitution, crafted resume content can terminate the intended context and introduce arbitrary HTML. A malicious link can also use an unsafe scheme such as ...[truncated 1688 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (30)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/academic.md (reported line 78)May include surrounding context.

md
---

<!-- Template: Academic
     Style: Formal academic CV, multi-page supported
     Best for: Faculty, postdoc, research, PhD applications
     Font suggestion: Times New Roman 11pt or Garamond 11pt

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/minimal.md (reported line 33)May include surrounding context.

md
---

<!-- Template: Minimal
     Style: Ultra-clean, whitespace-focused, maximum content density
     Best for: Senior professionals, engineering, experienced candidates
     Font suggestion: System UI 11pt

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README encourages very broad natural-language triggers such as 'Here's my resume, can you help?' and states that the assistant will automatically route intent. In an agentic environment, this can cause unintended skill activation on ambiguous user input, increasing the chance that sensitive resume data is processed or transformed without explicit user confirmation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 177)May include surrounding context.

Option 3: REST API

bash
curl -X POST https://your-agent-api.com/skills/resume-assistant/polish \
  -H "Content-Type: application/json" \
  -d '{
    "resume_content": "Your resume content...",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_ZH.md (reported line 187)May include surrounding context.

Option 3: REST API

bash
curl -X POST https://your-agent-api.com/skills/resume-assistant/polish \
  -H "Content-Type: application/json" \
  -d '{
    "resume_content": "Your resume content...",

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

该 README 明确鼓励用户“直接描述你的需求”，并列出如“帮我看看”“我的简历有什么问题？”这类高频、宽泛表达作为触发方式。文档虽展示了示例，但没有给出触发边界、排除条件或负面示例，容易让代理在普通求助语境下也错误调用该技能。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill explicitly asks users to paste resumes and job descriptions, which commonly contain sensitive PII, employment history, contact details, and sometimes protected personal information, but provides no privacy, retention, or transmission warning. This increases the chance that users or integrators will send sensitive documents through agents or APIs without informed consent or data-handling safeguards.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill encourages invocation through very broad natural-language phrases like 'Here's my resume, can you help?' and 'What's wrong with my resume?'. In agents that auto-route based on loose intent matching, this can cause accidental skill activation on ordinary conversation and lead to unnecessary processing or disclosure of highly sensitive personal data contained in resumes.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

bash
# Polish a resume
curl -X POST https://your-agent-api.com/skills/resume-assistant/polish \
  -H "Content-Type: application/json" \
  -d '{
    "resume_content": "Your resume content...",

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The command-routing guidance uses ambiguous keywords such as 'help', 'fix', 'job', 'apply', 'score', and 'convert' to select workflows. In a general-purpose AI agent, these common terms can overlap with unrelated requests, causing unintended routing, prompt loading, and submission of user content into this skill's processing path.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advertises very broad natural-language triggers such as '这是我的简历，帮我看看' and '根据这个职位描述定制我的简历：[粘贴 JD]', which can cause an agent to activate the skill during ordinary conversation and encourage users to paste highly sensitive personal and employment data. In a multi-skill agent, this broad routing increases the chance of unintentional processing or forwarding of resumes and job descriptions without a clear consent boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The API and workflow examples invite users to submit full resume and job-description content, but there is no prominent privacy warning immediately before those examples. Because resumes commonly contain names, phone numbers, email addresses, employment history, and other sensitive personal data, this omission can lead to unnecessary disclosure to remote agent backends or third-party infrastructure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The documentation explicitly shows sending raw resume content to an HTTP API endpoint via POST, which is an external transmission of potentially sensitive personal data. Even though the host is a placeholder, the pattern normalizes transmitting resumes off-platform and, without nearby trust, retention, or redaction guidance, increases the risk of data exposure through logging, third-party services, or misconfigured endpoints.

Content

Scanner excerpt · SKILL_ZH.md (reported line 211)May include surrounding context.

bash
# 简历润色
curl -X POST https://your-agent-api.com/skills/resume-assistant/polish \
  -H "Content-Type: application/json" \
  -d '{
    "resume_content": "你的简历内容...",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The prompt instructs users to submit full resume content, which commonly contains sensitive personal data such as name, phone number, email, location, employment history, and education details, but it provides no privacy warning, minimization guidance, or redaction recommendation. This increases the risk of unnecessary collection and exposure of personal data, especially if users include more identifying information than required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest sets the optional language argument default to "en" for commands instead of prompting for or inheriting user preference. This can violate language/locale policy expectations when the user has not opted into English, especially since the skill otherwise supports both English and Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The customize command defaults the language to English, which forces a locale choice without user opt-in. Since the skill advertises bilingual support, this default is not clearly justified by a region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

As with other commands, the language argument defaults to "en" even though supported languages include English and Chinese. This creates a language-policy issue because the skill may respond in English regardless of the user's preferred language.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This is a manifest file, so vague trigger review applies. Phrases such as "create a resume for", "write a resume for", "convert to", and "save as" are broad and lack constraints about context, required resume content, or negative examples, which could cause unintended invocation from ordinary conversation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Multiple commands define a language argument but default it to "en," which can force English output unless the user notices and overrides it. The file does not indicate that the user is offered an explicit language choice before applying this default, despite also supporting Chinese.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest defines broad trigger phrases such as "fix my resume," "review my resume," "create a resume for," "convert to," and "save as" without explicit constraints or negative examples. In a manifest file, this can cause accidental activation because the phrases are not tightly scoped to a command invocation context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file is entirely written in Chinese, and there is no natural-language indication that the language is optional, user-selected, or required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in can be a locale policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The guide repeatedly encourages users to paste full resumes and job descriptions, which commonly contain personally identifiable information such as full names, email addresses, phone numbers, employment history, and education details, without any privacy warning or minimization guidance. This increases the likelihood of oversharing sensitive data into the system and can lead to unnecessary exposure, retention, or downstream processing of personal information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The examples specify English as the language in multiple inputs, which can imply a fixed language expectation. Because the document does not state that users may choose another language or that English is merely an example, this may conflict with language/locale choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The examples specify English as the language in multiple inputs, which can imply a fixed language expectation. Because the document does not state that users may choose another language or that English is merely an example, this may conflict with language/locale choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The examples specify English as the language in multiple inputs, which can imply a fixed language expectation. Because the document does not state that users may choose another language or that English is merely an example, this may conflict with language/locale choice policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.