Ai Talent Grader

• Outcome: Review
• Latest audit: Jul 24, 2026 · 10:19 AM UTC
• Version: 3.3.2

Overview

This skill appears purpose-built for AI hiring assessment, but it handles sensitive candidate materials with broad auto-activation and weak data-handling disclosure.

Review before installing. Use this only in an environment approved for candidate resumes and interview transcripts, redact unnecessary personal data, and avoid auto-processing uploads without explicit user intent. The publisher should add privacy/retention guidance, narrow the trigger language, fix the invalid YAML, and pin reviewed dependency versions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill explicitly describes parsing uploaded files, batch processing candidate documents, and CLI flows that read resumes/interview transcripts and write reports, but it declares no permissions. That mismatch is dangerous because it hides the skill’s effective capabilities from reviewers and users, weakening least-privilege controls and informed consent around access to sensitive candidate data.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The YAML under critical_review contains nested double quotes inside double-quoted scalars, which makes the configuration syntactically invalid or ambiguously parsed. In a skill that relies on these rules for resume auditing and candidate grading, malformed policy entries can disable red-flag handling, cause parser failure, or trigger fallback behavior that silently skips critical review logic.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The action strings in non_balanced_rules are also malformed due to unescaped nested quotes, making the advertised scoring logic unreliable as executable configuration. Because these rules affect downgrade/upgrade annotations and L4 constraints, parse errors or ignored entries can materially alter candidate evaluations and undermine consistency, fairness, and auditability.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README instructs users to upload resumes and interview records, which commonly contain sensitive personal data, but provides no privacy notice, handling guidance, minimization requirements, or retention/deletion expectations. In a hiring-assessment skill, this omission increases the risk of inappropriate collection, over-sharing, and noncompliant processing of candidate data.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger text includes broad phrases such as 看简历, 简历审计, and 面试完帮我打分, which can match many generic resume-review or interview-help requests outside the narrowly intended AI-talent grading use case. Over-broad activation is risky because the skill may engage on unrelated hiring tasks and process sensitive applicant materials when a more appropriate or less invasive tool should have been used.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The statement that the skill auto-triggers when users upload a resume file, interview notes, or ask for evaluation is ambiguous and expansive, especially given the highly sensitive HR context. In practice this can cause unsolicited activation on routine document uploads, increasing the chance of unnecessary analysis of personal data and incorrect routing of user requests.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file is written entirely in Chinese and provides no indication that the language should be selected based on user preference. In a general-purpose agent skill, this can cause the agent to respond in a language the user did not request, degrading usability and potentially causing misinterpretation of evaluation results or interview guidance.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pypdf2>=3.0.0
python-docx>=0.8.11
pyyaml>=6.0
jinja2>=3.1.0

• Confidence: 92% confidence
• Finding: The dependency is specified with only a lower bound, which makes builds non-reproducible and allows future installs to resolve to unexpected versions, including newly introduced vulnerable releases. In a skill that processes user-supplied resumes and documents, dependency drift can increase supply-chain risk and operational instability.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pypdf2>=3.0.0
python-docx>=0.8.11
pyyaml>=6.0
jinja2>=3.1.0
openai>=1.0.0

• Confidence: 92% confidence
• Finding: Using an unpinned python-docx dependency permits uncontrolled version resolution at install time, which can introduce breaking changes or vulnerable transitive dependencies. Because this skill likely ingests untrusted candidate documents, maintaining deterministic dependency versions is important for secure parsing behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pypdf2>=3.0.0
python-docx>=0.8.11
pyyaml>=6.0
jinja2>=3.1.0
openai>=1.0.0
pandas>=2.0.0

• Confidence: 92% confidence
• Finding: An unpinned pyyaml version creates a supply-chain and reproducibility risk because future installs may silently pull different code than was tested. While this file alone does not prove unsafe YAML loading, leaving the package unpinned increases the chance of introducing vulnerable behavior over time.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pypdf2>=3.0.0
python-docx>=0.8.11
pyyaml>=6.0
jinja2>=3.1.0
openai>=1.0.0
pandas>=2.0.0
openpyxl>=3.1.0

• Confidence: 95% confidence
• Finding: The unpinned jinja2 requirement is more dangerous than a generic version-drift issue because the listed minimum version is itself associated with multiple advisories, and future resolution is uncontrolled. If this skill renders templates using resume, interview, or JD content, template-engine flaws can become directly reachable.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-docx>=0.8.11
pyyaml>=6.0
jinja2>=3.1.0
openai>=1.0.0
pandas>=2.0.0
openpyxl>=3.1.0
rich>=13.0.0

• Confidence: 90% confidence
• Finding: The openai package is unpinned, which can cause unexpected API, behavior, or security changes across deployments. This is primarily a supply-chain hygiene issue rather than a direct exploitable bug based on the requirements file alone.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pyyaml>=6.0
jinja2>=3.1.0
openai>=1.0.0
pandas>=2.0.0
openpyxl>=3.1.0
rich>=13.0.0
pydantic>=2.0.0

• Confidence: 90% confidence
• Finding: An unpinned pandas dependency makes builds non-deterministic and can expose the skill to unreviewed upstream changes. Since this skill may process spreadsheet-like candidate data, stable and reviewed parser behavior matters for security and reliability.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

jinja2>=3.1.0
openai>=1.0.0
pandas>=2.0.0
openpyxl>=3.1.0
rich>=13.0.0
pydantic>=2.0.0
loguru>=0.7.0

• Confidence: 90% confidence
• Finding: openpyxl is specified with only a minimum version, allowing installations to vary over time and increasing supply-chain uncertainty. Because spreadsheet parsing often handles untrusted files, deterministic dependency management reduces risk from parser regressions or newly introduced flaws.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.0.0
pandas>=2.0.0
openpyxl>=3.1.0
rich>=13.0.0
pydantic>=2.0.0
loguru>=0.7.0
click>=8.1.0

• Confidence: 88% confidence
• Finding: The rich dependency is unpinned, creating a reproducibility and supply-chain integrity issue. This is a lower-severity finding because terminal formatting libraries are typically less exposed, but uncontrolled upgrades can still introduce risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=2.0.0
openpyxl>=3.1.0
rich>=13.0.0
pydantic>=2.0.0
loguru>=0.7.0
click>=8.1.0

• Confidence: 94% confidence
• Finding: The pydantic dependency is unpinned and the minimum version cited is associated with a known ReDoS advisory, making this more than a generic hygiene issue. If the skill validates attacker-controlled text from resumes or interview notes, vulnerable validation paths could be abused for denial of service.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openpyxl>=3.1.0
rich>=13.0.0
pydantic>=2.0.0
loguru>=0.7.0
click>=8.1.0

• Confidence: 88% confidence
• Finding: The loguru dependency is unpinned, which permits uncontrolled version selection and weakens supply-chain reproducibility. This is mainly a hygiene and stability concern based on the requirements file alone.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rich>=13.0.0
pydantic>=2.0.0
loguru>=0.7.0
click>=8.1.0

• Confidence: 93% confidence
• Finding: The click dependency is unpinned and the minimum version reported is associated with a command injection advisory, increasing the risk beyond normal dependency drift. If this skill exposes CLI entry points that pass untrusted data into command handling patterns, the consequences could be more serious.

Known Vulnerable Dependency: pypdf2==3.0.0 — 2 advisory(ies): CVE-2023-36464 (pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a chara); CVE-2023-36464 (pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a chara)

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: PyPDF2 3.0.0 is flagged for an infinite-loop denial-of-service issue during PDF parsing. This skill's stated purpose includes reviewing resumes, and resumes are commonly supplied as PDFs from untrusted users, so a crafted file could hang processing or exhaust worker capacity.

Known Vulnerable Dependency: jinja2==3.1.0 — 10 advisory(ies): CVE-2025-27516 (Jinja2 vulnerable to sandbox breakout through attr filter selecting format metho); CVE-2024-56201 (Jinja has a sandbox breakout through malicious filenames); CVE-2024-22195 (Jinja vulnerable to HTML attribute injection when passing user input as keys to ) +7 more

Critical

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: Jinja2 3.1.0 is associated with multiple serious advisories, including sandbox breakout and injection-related issues. In a system that likely generates reports, prompts, or scoring outputs from user-controlled resume and interview content, unsafe template rendering could expose code execution, data leakage, or privilege-boundary bypass risks depending on usage.

Known Vulnerable Dependency: pydantic==2.0.0 — 2 advisory(ies): CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2024-3772 (Pydantic regular expression denial of service)

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: Pydantic 2.0.0 is flagged for a regular-expression denial-of-service issue. Given that this skill likely validates and structures large amounts of attacker-controlled text from resumes, interview transcripts, and job descriptions, a crafted payload could trigger excessive CPU consumption and degrade service availability.

Known Vulnerable Dependency: click==8.1.0 — 1 advisory(ies): CVE-2026-7246 (Pallets Click, versions 8.3.2 and below, contain a command injection vulnerabili)

High

• Category: Supply Chain
• Confidence: 61% confidence
• Finding: The scanner reports click 8.1.0 as affected by a command injection advisory, but the advisory text appears inconsistent because it references versions 8.3.2 and below despite this environment only specifying a minimum version. This should be treated as potentially real but requiring verification; if the skill uses Click together with shell command construction from untrusted input, the impact could be severe.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.