校招产品经理教练

• Outcome: Review
• Latest audit: Aug 14, 2026 · 1:45 PM UTC
• Version: 1.0.1

Overview

The main skill is a coherent resume review tool, but OCR mode uploads resume documents to Tencent Cloud and some unused legacy helper files would auto-install packages if invoked.

Safe to install for normal resume/JD review if you are comfortable with the documented behavior. Use text input for local-only processing; using image/PDF OCR may upload the resume, including contact and work-history details, to Tencent Cloud under your credentials. Review optimized resume wording before sending it to employers, and avoid invoking the legacy helper modules unless you accept their runtime package-install and .env-loading behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

from tencentcloud.hunyuan.v20230901 import hunyuan_client, models  # noqa: F401
    except (ImportError, ModuleNotFoundError):
        print("[INFO] tencentcloud-sdk-python-hunyuan 未安装，正在安装...", file=sys.stderr)
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "tencentcloud-sdk-python-hunyuan", "-q"],
            stdout=sys.stderr,
            stderr=sys.stderr,

• Confidence: 95% confidence
• Finding: The code automatically invokes pip at runtime to install a package when the import is missing. Even though the command is hardcoded and does not use shell interpolation, this still expands the file's capabilities from an API wrapper into environment modification and code acquisition from package indexes, which can introduce supply-chain risk and unexpected execution in privileged or production contexts.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import tencentcloud  # noqa: F401
    except (ImportError, ModuleNotFoundError):
        print("[INFO] tencentcloud-sdk-python 未安装，正在安装...", file=sys.stderr)
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "tencentcloud-sdk-python", "-q"],
            stdout=sys.stderr,
            stderr=sys.stderr,

• Confidence: 96% confidence
• Finding: The code automatically invokes pip at runtime to install a package when imports fail. Even though the package name is hardcoded and shell injection is not present, this still grants the skill code execution capability and performs network-dependent software installation during normal operation, which is risky in production and can be abused through dependency confusion, compromised package sources, or unexpected environment side effects.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import PIL  # noqa: F401
    except (ImportError, ModuleNotFoundError):
        print("[INFO] Pillow 未安装，正在安装...", file=sys.stderr)
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "Pillow", "-q"],
            stdout=sys.stderr,
            stderr=sys.stderr,

• Confidence: 96% confidence
• Finding: This block performs automatic runtime installation of Pillow through pip via subprocess. While not obviously malicious, it introduces unnecessary code execution and supply-chain exposure at runtime, which is especially problematic in an agent skill that should ideally only process files, not modify its own environment.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import fitz  # noqa: F401
    except (ImportError, ModuleNotFoundError):
        print("[INFO] PyMuPDF 未安装，正在安装...", file=sys.stderr)
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "PyMuPDF", "-q"],
            stdout=sys.stderr,
            stderr=sys.stderr,

• Confidence: 96% confidence
• Finding: The skill installs PyMuPDF dynamically by spawning pip during execution. This creates avoidable supply-chain and operational risk because processing a user file can trigger package installation and environment changes, expanding the attack surface beyond the OCR function's stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Auto-installing Python packages from within an LLM client is a risky behavior because it fetches and executes third-party code during normal application flow. In a skill context, this is more dangerous because loading the skill can trigger environment changes without operator review, increasing supply-chain and operational risk.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Across ensure_dependencies(), the skill can execute pip installs for multiple packages at runtime. For an OCR helper, this is broader capability than necessary and materially increases risk by enabling network access, environment mutation, and third-party code retrieval during document handling.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The helper accepts arbitrary HTTP/HTTPS URLs and downloads remote content to a local temporary file. This broadens the attack surface from local OCR into outbound network fetching, which can enable SSRF-like misuse, untrusted content ingestion, privacy issues, and processing of attacker-controlled files without validation.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The skill promises it will not fabricate or exaggerate content, but its verb-upgrade behavior can strengthen ownership phrasing beyond the source wording, such as converting weaker participation language into stronger contribution claims. In a resume optimizer, this is risky because it can misrepresent a candidate’s actual role and produce deceptive output despite the stated safety guarantees.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill processes resumes via external OCR and extraction services, which likely transmit sensitive personal data such as names, schools, internships, and project history to third-party cloud endpoints. Without an explicit privacy warning, consent notice, or data-handling disclosure, users may unknowingly expose personal information, creating privacy, compliance, and confidentiality risks.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The capability text says the skill can 'automatically recognize optimization intent' and 'directly generate a new resume document', which creates ambiguity about when user content may be transformed or acted on. In a resume-processing context, this can lead to unintended modification of sensitive personal data or surprising automated actions without explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The manifest declares dependencies on Tencent Cloud OCR and ExtractDocAgent for resume/document processing but does not warn users that resume contents may be transmitted to external services. Because resumes often contain highly sensitive personal data, missing disclosure and consent can cause privacy, compliance, and data-handling risks if users unknowingly upload documents.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: When --resume-file is used, the code sends resume content to external OCR/field-extraction services, and the overall workflow also processes highly sensitive resume and JD data without any explicit consent notice, privacy warning, or data-handling disclosure. Because resumes commonly contain personal identifiers, contact details, education, and work history, silent transmission to third-party services creates a real privacy and compliance risk rather than a purely cosmetic issue.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This code sends resume images/PDF content to Tencent Cloud OCR, which can include highly sensitive personal data such as names, phone numbers, email addresses, education history, and work experience. The security issue is not the API call itself but the lack of any explicit consent, disclosure, or privacy control in this component before transmitting that data to a third-party cloud service.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The OCR routine base64-encodes resume images/PDF-rendered pages and sends them to Tencent Cloud for recognition, but there is no explicit user notice, consent mechanism, or data-handling disclosure. Because resumes commonly contain sensitive personal data, silent transmission to a third-party cloud service creates significant privacy, compliance, and confidentiality risk.

Credential Access

High

• Category: Privilege Escalation

Content

def _find_env_file() -> str:
    """从脚本所在目录逐级向上查找 .env 文件，最多向上 5 级。"""
    try:
        current = os.path.dirname(os.path.abspath(__file__))
        for _ in range(5):

• Confidence: 84% confidence
• Finding: The function searches upward through parent directories for the first .env file and treats it as authoritative. In shared or untrusted directory layouts, this can cause the program to load attacker-controlled credentials or configuration from an unexpected parent directory, creating a configuration injection risk even though there is no direct exfiltration in this module.

Credential Access

High

• Category: Privilege Escalation

Content

try:
        current = os.path.dirname(os.path.abspath(__file__))
        for _ in range(5):
            env_path = os.path.join(current, ".env")
            if os.path.isfile(env_path):
                return env_path
            parent = os.path.dirname(current)

• Confidence: 86% confidence
• Finding: Using the first discovered parent-directory .env file without establishing trust boundaries can result in loading secrets or settings from an unintended file. If an attacker can place or influence a .env file in a traversed parent path, they may alter runtime behavior or substitute API credentials.

Credential Access

High

• Category: Privilege Escalation

Content

def _ensure_env_loaded() -> None:
    """将 .env 文件中的变量加载到 os.environ（不覆盖已有系统环境变量）。幂等。"""
    env_path = _find_env_file()
    if not env_path:
        return

• Confidence: 88% confidence
• Finding: Automatically importing all keys from a discovered .env file into os.environ broadens the attack surface beyond the two required Tencent Cloud secrets. A malicious or misplaced .env file could inject unrelated environment variables that change downstream program behavior, especially because the loader silently accepts any key and suppresses exceptions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 腾讯云 OCR SDK（简历图片/PDF 识别，矩阵内技能 tencentcloud-ocr）
tencentcloud-sdk-python>=3.0.1100

• Confidence: 93% confidence
• Finding: The dependency is only lower-bounded and not pinned to an exact version, which makes builds non-reproducible and can allow unintended newer releases to be installed. If an upstream release is compromised, vulnerable, or introduces breaking behavior, deployments may silently consume it and expand supply-chain risk.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/env_loader.py:18