ClawHub
Back to skill

Security audit

Resume Optimizer

Security checks for vulnerabilities and agentic risk

Overview

This resume tool is coherent and purpose-aligned, but users should be careful because resume data is sensitive and exported files remain on disk.

Install only if you are comfortable sharing resume/JD content with the local agent workflow. Redact unnecessary sensitive details first, choose the output directory deliberately, and prefer DOCX export unless PDF is required. For higher-assurance environments, pin dependencies and use a trusted absolute LibreOffice path before enabling PDF conversion.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill describes capabilities to read user files, write intermediate and exported resume files, and execute shell/Python commands, yet no explicit permissions are declared. That creates a trust and containment gap: an operator or user cannot reliably understand or restrict what the skill may do before processing highly sensitive resume data.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The skill instructs use of shell commands and execution of a local Python script to create exports from resume content. Running shell/script tooling on untrusted content increases the attack surface for command injection, path manipulation, unsafe dependency use, and unintended filesystem access, especially when handling user-supplied filenames and documents.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
Falling back to system-level archive extraction for .docx parsing introduces command execution into a workflow that processes user-provided files. Even if intended only for parsing, invoking archive tools on untrusted inputs can expose the host to zip-slip style path issues, parser vulnerabilities, or broader shell abuse if arguments are not tightly controlled.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill processes highly sensitive personal and professional data from resumes and job descriptions, yet it lacks a prominent privacy warning and consent boundary. Users may disclose PII, employment history, compensation clues, and contact details without being told how data will be processed, stored, or written to disk.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs writing intermediate and exported resume artifacts to local storage without a prominent pre-write warning. Because resumes contain sensitive PII, silent or poorly signposted file creation can leave personal data on disk unexpectedly, increasing exposure to other local users, backups, indexing services, or later exfiltration.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The file defines all interaction templates and handling logic in Chinese and does not provide any mechanism to detect, preserve, or ask for the user's preferred language. In a multilingual assistant context, this can cause unintended language switching, degrade usability, and create fairness/accessibility issues for users who do not read Chinese, especially when handling sensitive resume content and consent-style confirmations.

Unvalidated Output Injection

High
Category
Output Handling
Content
]
    for c in candidates:
        try:
            subprocess.run([c, "--version"], capture_output=True, timeout=10)
            return c
        except (FileNotFoundError, subprocess.TimeoutExpired, OSError):
            continue
Confidence
72% confidence
Finding
The code trusts a bare command name from PATH ('soffice' or 'libreoffice') and executes it during detection. In an agent or plugin environment where PATH can be influenced by another local actor or prior step, a malicious binary with that name could be executed, leading to arbitrary code execution under the agent's privileges.

Unvalidated Output Injection

High
Category
Output Handling
Content
docx_path,
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
        if result.returncode == 0:
            pdf_path = str(Path(docx_path).with_suffix(".pdf"))
            if Path(pdf_path).exists():
Confidence
78% confidence
Finding
After PATH-based discovery, the script executes the selected LibreOffice binary on attacker-influenced document and output paths. If an attacker can plant or substitute the executable found earlier, this becomes arbitrary code execution; additionally, document conversion through a large external parser increases attack surface in an automation context handling untrusted resume files.

Unpinned Dependencies

Low
Category
Supply Chain
Content
python-docx>=0.8.11
reportlab>=4.0.0
Confidence
95% confidence
Finding
The dependency is specified with only a lower bound, which allows future unreviewed versions of python-docx to be installed. This creates supply-chain risk because a breaking, vulnerable, or malicious upstream release could be pulled into the skill without explicit approval or testing.

Unpinned Dependencies

Low
Category
Supply Chain
Content
python-docx>=0.8.11
reportlab>=4.0.0
Confidence
95% confidence
Finding
The dependency is not pinned to an exact version, so any newer reportlab release satisfying the constraint may be installed. That increases supply-chain exposure and can introduce vulnerable or incompatible versions during deployment or rebuilds.

Static analysis

No suspicious patterns detected.