Resume To Tags

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:16 AM UTC
• Version: 1.0.1

Overview

This skill has a coherent resume-tagging purpose, but it handles sensitive candidate data and writes extra contact information without enough disclosure or controls.

Review before installing. Use this only with resumes you are allowed to process, avoid sending or saving unnecessary contact details, validate LLM output before importing to Feishu, and confirm the target Feishu table/app before any create, delete, or batch import actions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract_tags.py:67

Finding

Unnecessary Plaintext Collection and Disclosure of Candidate Contact Information

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract_tags.py:39

Finding

Untrusted Resume Content Is Embedded Directly into an LLM Instruction Prompt

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented workflow claims end-to-end resume extraction, synonym expansion, Feishu table creation, record import, and cleanup, but the detected behavior does not actually perform most of those actions and additionally extracts phone numbers and email addresses not disclosed in the description. This mismatch is dangerous because users may consent to simple tagging while the skill processes extra personally identifiable information, creating hidden privacy and compliance risk.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/extract_tags.py (reported line 121)May include surrounding context.

python

else:
        print(json.dumps(result, ensure_ascii=False, indent=2))

    return prompt

if __name__ == '__main__':
    main()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill advertises file-based processing and references local scripts, but it does not declare an explicit tool scope such as allowed-tools or permissions. In practice, this can cause the runtime to grant broader file read/write capability than users expect, weakening least-privilege boundaries and making accidental or unauthorized file access harder to audit.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This skill is explicitly designed to process resumes and import candidate information into Feishu, which inherently involves sensitive personal data such as employment history, education, contact details, and inferred attributes. Without a clear warning, consent flow, minimization guidance, or storage/transfer disclosure, the skill encourages handling regulated HR data in a way that can violate privacy expectations and organizational compliance requirements.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring and manifest describe a complete resume-to-tags extraction step with synonym expansion, but the implemented code does not call an LLM, parse extraction results, or apply synonym expansion to any extracted tags. Instead, it returns a prompt template plus basic_info containing phone/email and an instruction telling a downstream caller to do the real work.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script extracts phone numbers and email addresses from resumes even though the stated skill purpose is generating a pure tag matrix. In this context, collecting direct identifiers expands the sensitivity of processed data, increases privacy exposure, and creates unnecessary PII retention that could be leaked through console output or saved files.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions field says to send the prompt to an LLM, obtain JSON extraction results, and then expand tags with synonyms, implying this script is part of that implemented flow. In reality, no extracted tags are produced and expand_with_synonyms is never called, so the documented behavior contradicts the actual code path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

When --output is used, the script writes resume-derived data, including extracted contact information and the full prompt containing resume content, to disk without safeguards or explicit privacy warnings. In a resume-processing skill, this creates a real confidentiality risk because highly sensitive candidate data may be stored in plaintext files, copied into logs, or handled by downstream tools without consent or retention limits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The activation guidance says to use the skill when the user provides a resume and asks for several specific Chinese phrases, with no indication that other languages are supported or that the Chinese-only phrasing is merely illustrative. This can amount to an implicit language constraint without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The embedded natural-language prompt requires the model to operate and respond in Chinese, including Chinese field examples and instructions, with no opt-in or language selection mechanism. This can violate language/locale policy expectations when a skill should not force a specific language by default.

Content

No source excerpt is available for this finding.