Resume Project Analyzer

• Outcome: Review
• Latest audit: May 28, 2026 · 8:47 AM UTC
• Version: 1.0.3

Overview

The resume skill has a coherent main purpose, but it installs many unrelated skills, scripts, and powerful references that go well beyond resume writing.

Review before installing. The main resume analyzer is not clearly malicious, but install it only if you are comfortable with repository scanning, git metadata inspection, automatic local resume-library storage, and the presence of unrelated bundled tooling. A safer version would contain only the resume-project files and make persistence and git metadata reads explicit opt-in choices.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (174)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

src = Path(tempfile.gettempdir()) / "lo_socket_shim.c"
    src.write_text(_SHIM_SOURCE)
    subprocess.run(
        ["gcc", "-shared", "-fPIC", "-o", str(_SHIM_SO), str(src), "-ldl"],
        check=True,
        capture_output=True,

• Confidence: 95% confidence
• Finding: The code writes C source into a world-writable temporary directory and then compiles it into a shared object that is later injected with LD_PRELOAD. Using predictable temp paths for source and output introduces a path/symlink race that can let a local attacker replace files, influence compilation, or cause arbitrary shared libraries to be loaded into the LibreOffice process.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

src = Path(tempfile.gettempdir()) / "lo_socket_shim.c"
    src.write_text(_SHIM_SOURCE)
    subprocess.run(
        ["gcc", "-shared", "-fPIC", "-o", str(_SHIM_SO), str(src), "-ldl"],
        check=True,
        capture_output=True,

• Confidence: 97% confidence
• Finding: The code writes C source into a world-writable temporary directory and compiles it into a shared object that is later injected via LD_PRELOAD. This creates a dangerous path for local tampering, race conditions, or binary/source replacement in temp storage, and materially increases the skill's ability to alter process behavior at runtime.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"Starting server {i+1}/{len(servers)}: {server['cmd']}")

            # Use shell=True to support commands with cd and &&
            process = subprocess.Popen(
                server['cmd'],
                shell=True,
                stdout=subprocess.PIPE,

• Confidence: 99% confidence
• Finding: `subprocess.Popen` is invoked with `shell=True` on a fully attacker-controlled string (`server['cmd']`). If an untrusted user, repo, config, or prompt can influence `--server`, shell metacharacters like `;`, `&&`, backticks, or `$()` can execute arbitrary OS commands under the agent's privileges. In an agent skill that may auto-scan or operate on external projects, this context makes the issue more dangerous because repository-controlled inputs can become code execution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

src = Path(tempfile.gettempdir()) / "lo_socket_shim.c"
    src.write_text(_SHIM_SOURCE)
    subprocess.run(
        ["gcc", "-shared", "-fPIC", "-o", str(_SHIM_SO), str(src), "-ldl"],
        check=True,
        capture_output=True,

• Confidence: 97% confidence
• Finding: This code writes C source into a world-writable temporary directory, compiles it into a shared object, and later injects it via LD_PRELOAD. That creates a powerful code-execution primitive and introduces tampering and race-condition risk if another local process can replace the source or output file in the temp path before use.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes sensitive capabilities including shell, file read/write, environment access, and MCP, but does not declare permissions or narrow their use. This creates an opaque trust boundary where a resume-writing skill can access local data and execute actions well beyond user expectations, increasing the risk of unintended data exposure or command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose is resume assistance, but the detected behavior set spans many unrelated and powerful document, automation, packaging, testing, and MCP-management activities. Such a large mismatch is a strong indicator of hidden functionality or supply-chain abuse because users would authorize the skill for benign writing help while it can perform broad, unexpected operations.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill automatically persists user project history and profile-like context to a local library, which exceeds the core task of generating resume bullets from current input. Persisting career data without explicit opt-in creates privacy and retention risks, especially if the stored file later influences future sessions or is accessible to other tools.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The repository-scan flow reads contributor and git metadata that are not clearly necessary for resume drafting, extending data collection beyond source code analysis. This broadens exposure to personal or organizational information such as collaborator identities and repository provenance without clear notice or need.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Reading .git/config remote URLs and commit-author data can expose private repository locations, usernames, email addresses, and internal infrastructure details. For a resume-writing skill, this is unnecessary sensitive-data access and may leak information from local developer environments or corporate repos.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file pulls third-party JavaScript and font resources from external CDNs even though the declared skill is for resume/project-to-resume transformation, not web-based art rendering. This expands the attack surface through supply-chain and tracking risks, and creates unnecessary network behavior in a skill whose purpose does not justify those dependencies.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The contents implement a full generative-art HTML viewer rather than functionality aligned to the skill's stated resume-writing purpose. This mismatch is dangerous because it indicates hidden or misplaced capability, undermines trust boundaries, and can cause an agent or user to load unrelated active web content with client-side script execution and external fetches under a misleading skill identity.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to "download and use whatever fonts are needed," which expands behavior from local file generation into uncontrolled external network retrieval. That creates unnecessary supply-chain and data-exposure risk, especially because font sources are unspecified and the user is not clearly informed that network access may occur.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file is materially inconsistent with the declared purpose of a resume-project skill: instead of transforming project experience into resume bullets, it teaches raw Anthropic API usage with credentialed HTTP requests. That mismatch is dangerous because it can repurpose the skill into making external model calls and transmitting user-provided content off-platform under the guise of a benign resume-writing tool.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The content instructs users to export an API key and send prompts/results to an external service, which introduces unnecessary credential handling and data egress not justified by the stated resume-writing use case. In context, this expands the skill's capability from text editing to credentialed network access, increasing the risk of unintended disclosure of resumes, project details, or proprietary code descriptions.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file is a broad Go Claude API reference, not content scoped to a resume-writing skill. The mismatch materially increases the skill's available knowledge about tool use, files, server-side tools, code execution, and context management, creating capability drift that could enable off-purpose or unsafe agent behavior if the skill is invoked or repurposed.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The documented features include high-risk agentic and execution-capable tools such as bash, text editing, code execution, web search, and file operations, none of which are justified for resume authoring. In the context of a resume skill, exposing or normalizing these capabilities can facilitate unauthorized code execution, local file access, external data exfiltration, or autonomous actions far beyond user expectations.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file embeds documentation for broad, system-impacting Claude API capabilities such as web search, bash, code execution, MCP connectivity, and file operations that are unrelated to a resume-writing skill. In the context of an auto-triggered resume/project skill, this materially increases the chance that an agent exposes or invokes dangerous capabilities outside the user’s intent, enabling command execution, external access, or data handling beyond resume generation.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Documenting bash execution inside a resume-writing skill creates an unjustified path to shell access in a context where users expect text generation, not system command execution. If an agent uses this skill as contextual guidance, an attacker could steer it toward running local commands, causing data exposure or host modification far outside the intended functionality.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Code execution capability is unnecessary for resume bullet generation and introduces a direct avenue for arbitrary computation and potential abuse. In an auto-scanning skill that may inspect repositories, this can be combined with prompt injection or crafted inputs to run attacker-influenced code or process sensitive local content.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: MCP server connectivity enables communication with external services and expands the agent’s trust boundary well beyond resume-writing needs. In this skill context, it could permit exfiltration of repository contents, prompts, or user data to arbitrary remote endpoints under the guise of normal skill behavior.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The Files API example includes upload, download, and delete operations that are unrelated to resume writing and can affect sensitive user documents. In a skill that may auto-scan codebases or process project descriptions, these capabilities create unnecessary risk of remote data transfer, destructive actions, or unauthorized file handling.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This file documents MCP connectivity and powerful server-side tools like bash, text editing, web search, and code execution, which materially expand the capability surface far beyond a resume-writing skill. In the context of an agent skill that may be auto-selected for resume help, this creates a dangerous mismatch: users or downstream agents could invoke networked or execution-capable behaviors unrelated to the stated purpose, increasing risk of data exfiltration or unintended actions.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The documentation teaches generic external client setup for Anthropic, Bedrock, Vertex, and Foundry, including credential-backed connectivity, which is unnecessary for transforming project descriptions into resume bullets. This broadens the operational scope of the skill and may encourage credentialed remote access in workflows where users expect simple local content assistance.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file's contents are for generic Claude PHP SDK usage rather than resume-project transformation, indicating a substantial skill/behavior mismatch. In agent ecosystems, this kind of mismatch is dangerous because the skill may be selected under benign resume-related intent while exposing unrelated network, tooling, and execution patterns that users did not ask for.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This documentation includes browser automation via Playwright even though the stated skill purpose is resume generation from projects or pasted descriptions. In a skill package, showcasing unrelated web automation expands the apparent operational scope and can normalize use of external browsing capabilities that may access arbitrary sites or data, which is unjustified for this skill context.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.prompt_injection_instructions

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: skills/skills/claude-api/csharp/claude-api.md:21

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: skills/skills/claude-api/typescript/agent-sdk/patterns.md:199