简历工作台

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:14 AM UTC
• Version: 1.0.0

Overview

The skill mostly does what it claims, but its resume rendering can silently contact outside sites and run active HTML during PDF export.

Install only if you are comfortable with a resume skill that writes local HTML/PDF/image files and whose default templates may contact third-party hosts while rendering. Prefer replacing remote fonts/photos with local assets and rendering only trusted HTML in a network-restricted environment.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/render_pdf.py:86
• Finding: Unrestricted Active Content and Remote Resource Loading During HTML-to-PDF Rendering<![CDATA[ ## Vulnerability Details **File Location**: `scripts/render_pdf.py:86-105`; remote resource examples at `assets/template_refs/html/极客风尚.html:10-13,23`, `assets/template_refs/html/典雅酒红.html:173`, `assets/template_refs/html/极简纯白.html:10,18`, `assets/template_refs/html/沉稳双栏.html:7,13`, and `assets/template_refs/html/清新蓝灰.html:1` **Vulnerability Type**: Unrestricted browser execution and external resource retrieval **Risk Level**: Medium ### Vulnerable Code ```python def _html_to_pdf(in_path: Path, out_pdf: Path, paper: str, chrome_path: Path | None) -> None: chrome = chrome_path or _find_chrome() if not chrome or not chrome.exists(): raise RuntimeError( "Chrome not found. Install Google Chrome or put chrome.exe on PATH." ) in_path = _ensure_html_has_page_size(in_path, paper) out_pdf.parent.mkdir(parents=True, exist_ok=True) file_url = in_path.resolve().as_uri() cmd = [ str(chrome), "--headless=new", "--disable-gpu", "--no-first-run", "--no-default-browser-check", "--disable-extensions", f"--print-to-pdf={out_pdf.resolve()}", "--no-pdf-header-footer", "--print-to-pdf-no-header", file_url, ] _run(cmd) ``` The bundled templates demonstrate that network resources are loaded during rendering: ```html <!-- Font Awesome icon library --> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css"> <!-- Google Fonts --> <link href="https://fonts.googleapis.com/css2?family=NotoSansSC:wght@300;400;500;600;700&display=swap" rel="stylesheet"> <img src="https://oss-pai-wwja1ucw1pykevvz32-cn-shanghai.oss-cn-shanghai.aliyuncs.com/aicv/recv/photo.png" alt="李明轩证件照"> ``` ### Technical Analysis The documented compile-only workflow accepts an existing HTML file and passes its local `file://` URL directly to headless Chrome. The Chrome invocation does not disable JavaScript, block outb ...[truncated 2805 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. **Disable network access during rendering** - Run Chrome inside a network-isolated container or sandbox. - Enforce egress-deny rules at the operating-system or container level rather than relying solely on browser flags. - If remote resources are required, allow only explicitly approved hosts through a narrowly scoped allowlist. 2. **Sanitize untrusted HTML** - Reject or remove `<script>`, `<iframe>`, `<object>`, `<embed>`, active SVG content, event-handler attributes, `javascript:` URLs, and remote resource URLs. - Use a maintained allowlist-based HTML sanitizer. - Validate both HTML attributes and CSS constructs capable of loading external resources. 3. **Apply a restrictive Content Security Policy** - Inject a policy such as `default-src 'none'` and selectively permit only required local resources. - Set `script-src 'none'`, `connect-src 'none'`, `frame-src 'none'`, and `object-src 'none'`. - Restrict images, styles, and fonts to locally controlled files. 4. **Vendor all template assets locally** - Store fonts, icons, and placeholder images inside the Skill package. - Replace Google Fonts, Cloudflare CDN, and Aliyun OSS references with local relative paths. - If an external resource cannot be removed, pin and verify its expected cryptographic hash before use. 5. **Harden the renderer** - Execute Chrome as an unprivileged, dedicated user inside an ephemeral sandbox. - Limit CPU, memory, execution time, process count, and output size. - Use a temporary profile directory that is deleted after every render. - Keep Chrome's sandbox enabled and avoid adding flags such as `--no-sandbox`. 6. **Require explicit trust decisions** - Treat user-provided HTML as untrusted by default. - Require explicit confirmation before rendering documents that contain remote URLs or active content. - Log blocked resources without exposing resume contents or other personal information. ] ...[truncated 2 chars]

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 声明的用途是简历创建/修改与 HTML->PDF 交付流程，而实际代码完全没有执行任何简历内容生成、HTML 编辑、JD 定制、模板处理或 PDF 导出相关逻辑。相反，它只是在本地文件系统上查找 PDF 文件并计算页数。这是实质性的主功能不一致，而不是辅助实现细节。因此应判定为描述与行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 声明的核心用途是简历编写与按 JD 定制，工作对象应是简历内容/HTML 源文件，并以 PDF 简历为最终交付物。但实际代码完全是一个 PDF 转图片脚本：校验 PDF 输入、解析页码范围、调用 PyMuPDF/pdftoppm/ImageMagick 将 PDF 页面导出为图片文件。代码中没有任何简历内容生成、文本编辑、HTML 操作、JD 分析或 PDF 简历排版逻辑。因此其主要目的与声明严重不符，属于明显的描述-行为不匹配。

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

if "@page" in lower:
        return html_path

    # Otherwise inject a minimal print rule:
    # - set the paper size
    # - set @page margin to 0 to avoid browser defaults
    css = _paper_css(paper).replace("@page { size: ", "@page { size: ").replace("; }\n", "; margin: 0; }\n", 1)

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill describes workflows that require shell execution, file reads/writes, and likely access to local files, but it does not declare any explicit tool scope or permissions boundary. Without scoped tool restrictions, the runtime may grant broader capabilities than users expect, increasing the risk of unintended file access or command execution through normal use or prompt manipulation.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The instruction '固定使用 HTML 作为简历源文件格式' mandates a fixed format regardless of user preference. This is a natural-language policy concern because it imposes a specific choice without offering the user an opt-in or alternative, and the file does not document a justified constraint for this requirement.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The manifest enables implicit invocation for a skill that can directly generate and modify resume source files and export PDFs, but it defines no trigger scope, exclusions, or confirmation boundaries. That increases the chance the agent will invoke the skill in contexts the user did not clearly intend, causing unintended document creation, modification, or disclosure of resume content to the skill pipeline.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The document declares `lang="zh-CN"`, and the visible content is entirely Chinese, which enforces a specific language/locale in the template. There is no indication that this locale is optional, user-selected, or justified as region-specific, so it appears to violate the language-choice policy.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The template embeds a remotely hosted image for the resume photo, which causes network access when the HTML is rendered or exported. This can leak user IP address, access timing, and document usage metadata to a third party, and it violates the expected local-only nature of a resume template asset.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The external avatar dependency is unnecessary for resume editing and introduces a privacy and supply-chain risk unrelated to the skill's core function. A remote asset owner could change the image, track accesses, or serve unexpected content, making the template less trustworthy and less self-contained.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The template loads third-party remote assets from CDNs (Font Awesome and Google Fonts), which creates unnecessary outbound network requests during resume rendering. In a resume-generation skill, this expands the trust boundary, enables passive data leakage such as IP/user-agent/request timing, and introduces supply-chain or availability risk if those remote resources are changed, blocked, or unavailable.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The profile photo is fetched from an external OSS URL, which is unrelated to the core editing function and causes network access whenever the template is rendered. This can leak request metadata, break reproducibility/offline rendering, and allows remote content changes without modifying the local template.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The template fetches a Google Fonts stylesheet and loads a remote profile image from an Alibaba OSS domain. In a resume-generation skill whose stated purpose is local HTML editing and PDF export, these external requests create unnecessary third-party network dependencies that can leak user IP, user-agent, access timing, and potentially resume-related context during rendering, while also allowing remote content changes or tracking.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The document sets `lang="zh-CN"` and all visible content is written in Chinese, which imposes a specific language/locale on users. The file does not indicate that this is optional, user-selected, or justified as a region-specific template.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _run_capture(cmd: list[str], *, cwd: Path | None = None) -> str:
    proc = subprocess.run(
        cmd,
        cwd=str(cwd) if cwd else None,
        stdout=subprocess.PIPE,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _run_capture(cmd: list[str], *, cwd: Path | None = None) -> str:
    proc = subprocess.run(
        cmd,
        cwd=str(cwd) if cwd else None,
        stdout=subprocess.PIPE,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _run_capture(cmd: list[str], *, cwd: Path | None = None) -> str:
    proc = subprocess.run(
        cmd,
        cwd=str(cwd) if cwd else None,
        stdout=subprocess.PIPE,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The manifest describes a skill for creating or tailoring resumes by directly editing HTML and delivering printable PDFs. This script adds a separate capability to rasterize arbitrary PDFs into images and does so by spawning external tools such as pdftoppm and ImageMagick, which is not an obvious requirement for HTML resume authoring or PDF delivery.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The command-line entrypoint is explicitly designed to split a PDF into PNG/JPG page images, including page-range selection and multiple rendering engines. That behavior does not match the manifest's stated scope of generating/editing resumes as editable HTML and outputting printable PDFs; it introduces a distinct document-conversion workflow not mentioned in the description.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The workflow instructs the agent to create `<name>.html`, compile it to `<name>.pdf`, and generate image files from the PDF, which affects user files and workspace contents. The markdown does not explicitly warn the user that the skill will create and transform local files as part of execution.

Natural-Language Policy Violations

Low

• Confidence: 72% confidence
• Finding: The visible interface strings are in Chinese while the default prompt is fixed in English, which may impose a language choice implicitly rather than matching user preference. There is no natural-language indication that the user can choose their preferred language or locale.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: This plain-text skill file presents all user-facing content only in Chinese, which may impose a language constraint without any opt-in or justification. Under the natural-language policy rule, forcing a specific language can be a policy violation when no alternative or locale rationale is provided.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: Loading a remote photo without any user-facing notice means users may unknowingly trigger outbound requests while viewing or printing a resume. In this skill context, that is a transparency and privacy issue because the user reasonably expects offline document generation rather than hidden network activity.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The document declares `lang="zh-CN"`, and all visible content is presented only in Simplified Chinese. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The document sets the page language to "zh-CN", which imposes a specific language/locale on all users. The file contains no indication that this is optional, user-selected, or justified as a region-specific template, so it matches the language/locale policy concern.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The document declares `lang="zh-CN"`, which hard-codes a specific language/locale for the template. Under the policy criteria, forcing a locale without offering user choice or documenting a justified region-specific constraint is a natural-language policy concern.

Static analysis

No suspicious patterns detected.