ClawHub
Back to skill

Security audit

resume-parser

Security checks across malware telemetry and agentic risk

Overview

This resume parser does what it says: it sends a user-selected resume to SoMark for parsing after confirmation and saves the parsed results locally, but users should be aware of the privacy implications.

Install only if you are comfortable sending resume contents and extracted personal information to SoMark. Confirm the endpoint region before parsing, keep the API key in the environment rather than chat, and use an output directory appropriate for sensitive candidate data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill instructs the agent to access environment variables, read and write local files, and send resume contents to an external network service, but it does not explicitly declare those permissions. This creates a transparency and governance gap: users and platforms may not realize sensitive personal data and credentials are involved, increasing the risk of unintended data exposure or overbroad execution.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrases are broad enough to match ordinary conversation such as reviewing a resume or extracting candidate information, which can cause the skill to activate when the user did not intend to send a document to an external service. In this context, unintended invocation is more dangerous because resumes contain highly sensitive personal data and parsing consumes paid API quota.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill description does not clearly warn that uploaded resume files and extracted personally identifiable information will be transmitted to SoMark, a third-party external service. Because resumes commonly contain names, emails, phone numbers, employment history, and location data, omission of this disclosure can lead to uninformed consent and privacy violations.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.