简历助手免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 1.0.0

Overview

This resume helper has a normal purpose, but it asks for shell execution and vague callback/API handling that are not clearly needed for basic resume scoring, polishing, and export.

Review this skill before installing. Its resume functions are ordinary, but only use it in an agent environment where shell commands require approval or are disabled, avoid callback URLs unless you trust the destination, and redact unnecessary personal details from resumes before processing or exporting.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:13

Finding

Unnecessary Shell Execution Permission Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-16
Vulnerability Type: Excessive tool permissions
Risk Level: Medium

Vulnerable Code

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The skill requests the exec tool, which grants the agent a shell-command execution channel. The documented functionality is limited to analyzing resume text, improving its wording, and exporting generated content as Markdown or HTML. None of the documented workflows defines a legitimate need to execute operating-system commands.

Granting shell execution beyond the skill's functional requirements violates the principle of least privilege. Resume content is attacker-controllable input and may contain adversarial instructions. If the hosting agent does not adequately isolate data from instructions, such content could attempt to induce use of the declared exec capability.

The file does not itself contain a malicious command or direct the agent to invoke exec. Exploitation therefore depends on the host granting declared tools and allowing untrusted content to influence tool calls. Nevertheless, exposing an unnecessary command-execution capability materially increases the consequences of such an agent-control failure.

Attack Path

1. A user or attacker supplies a crafted resume containing adversarial instructions.
2. The skill is loaded with its declared exec permission available to the agent.
3. The agent incorrectly treats instructions embedded in the resume as trusted operational instructions.
4. The injected instructions induce the agent to invoke exec.
5. Commands execute with the operating-system privileges and environmental access assigned to the agent process.

No direct command, persistence mechanism, or data-exfiltration endpoint is present in the audited file; this path is conditional on unsafe behavior by the hosting agent.

Impact Assessment

Successful expl ...[truncated 558 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from the declared tools because no documented feature requires shell execution:

   yaml

   tools:
     - read
     - write
   

2. If resumes are supplied directly in the conversation and exports are returned as text, remove both filesystem tools as well.
3. If file export is required, restrict write to a dedicated output directory, reject absolute paths and traversal sequences, and prevent overwriting existing or executable files without explicit approval.
4. Treat all resume content as untrusted data and prohibit instructions found inside it from authorizing tool calls.
5. Require explicit user confirmation before any operation outside resume analysis or document generation.
6. Enforce runtime sandboxing, minimal filesystem permissions, restricted environment-variable access, and network isolation as defense-in-depth controls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description claims broad applicability for 'resume assistant related capabilities' and generic development scenarios without clear trigger boundaries or usage constraints. In agent ecosystems, overly broad activation language can cause the skill to be selected in contexts beyond resume processing, increasing the chance of unnecessary file access, command execution, or handling of unrelated sensitive data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill processes resumes, which commonly contain sensitive personal data such as names, contact details, employment history, and education records, yet it provides no warning or handling guidance for personal data exposure. Combined with declared read/exec/write capabilities and optional callback_url support, users may unknowingly submit or export PII in ways that increase leakage, retention, or exfiltration risk.

Content

No source excerpt is available for this finding.