Security audit

Resume Project Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This resume helper mostly matches its stated use, but it bundles many unrelated tools and automatically keeps career/project records, so it should be reviewed before installation.

Install only if you are comfortable with the skill reading project repositories, processing some Git metadata, and keeping a persistent resume library in your home directory. The publisher should remove the unrelated bundled skills repository or clearly split it into separate packages before normal users rely on this package.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

other

Warning

Location: SKILL.md:14
Finding: Automatic Access to Persistent Cross-Session Career and Project Data
Content: View full analysis
"✅ Saved to ~/.claude/resume-library.md (N projects total)" ``` ### Technical Analysis The Skill automatically reads and updates a cross-session file in the user's home directory. The stored schema can include repository paths, target roles, project context, employment information, architectural summaries, and other user-supplied career details. Persistent storage is disclosed in the Skill documentation, but the workflow does not require explicit consent before reading prior records or appending new records. The persistent profile is not necessary for the core task of generating resume content in the current session. No retention period, access isolation, deletion workflow, file-permission requirement, or data-minimization control is specified. This is not confirmed memory poisoning because the Skill does not deliberately store attacker-controlled instructions intended to alter future Agent behavior. It is instead excessive access to and retention of sensitive Agent state. ### Attack Path 1. A user invokes the Skill with a repository or project description. 2. The Skill reads all existing records from `~/.claude/resume-library.md`. 3. Prior career h ...[truncated 820 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:59
Finding: Unnecessary Collection of Repository Remotes and Contributor Email Addresses
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: skills/skills/skill-creator/eval-viewer/generate_review.py:259
Finding: Stored Script Injection Through Unsafe JSON Embedding in the Evaluation Viewer
Content: View full analysis
// ---- Embedded data (injected by generate_review.py) ---- /*__EMBEDDED_DATA__*/ ``` ### Technical Analysis `json.dumps()` produces valid JSON but does not make arbitrary strings safe for direct insertion into an HTML `` sequence even when it appears inside a JavaScript string. An attacker-controlled prompt, output file, grading field, previous feedback value, or benchmark field can therefore contain a payload such as: ```html ``` When inserted into the template, the first `` terminates the intended script block at the HTML-parser level. The following script then executes in the local viewer's origin. The later us ...[truncated 1667 chars]
Remediation: View remediation
``` Populate it using an HTML-safe serializer and parse its `textContent`. 3. At minimum, escape HTML-significant characters in serialized JSON: - `<` as `\u003c` - `>` as `\u003e` - `&` as `\u0026` - U+2028 as `\u2028` - U+2029 as `\u2029` 4. Add a restrictive Content Security Policy that disallows arbitrary inline and remote scripts. 5. Move viewer JavaScript to a local, integrity-controlled file and use a nonce or hash if inline code remains necessary. 6. Add regression tests using payloads containing ``, mixed-case terminators, HTML comments, and Unicode separators. 7. Treat prompts, generated outputs, feedback, grading data, and benchmark files as untrusted input. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: skills/skills/skill-creator/eval-viewer/generate_review.py:332
Finding: Unauthenticated Local Feedback API Permits Disclosure and Overwrite
Content: View full analysis
None: if self.path == "/" or self.path == "/index.html": runs = find_runs(self.workspace) benchmark = None if self.benchmark_path and self.benchmark_path.exists(): try: benchmark = json.loads(self.benchmark_path.read_text()) except (json.JSONDecodeError, OSError): pass html = generate_html(runs, self.skill_name, self.previous, benchmark) content = html.encode("utf-8") self.send_response(200) self.send_header("Content-Type", "text/html; charset=utf-8") self.send_header("Content-Length", str(len(content))) self.end_headers() self.wfile.write(content) elif self.path == "/api/feedback": data = b"{}" if self.feedback_path.exists(): data = self.feedback_path.read_bytes() self.send_response(200) self.send_header("Content-Type", "application/json") self.send_header("Content-Length", str(len(data))) self.end_headers() self.wfile.write(data) else: self.send_error(404) def do_POST(self) -> None: if self.path == "/api/feedback": length = int(self.headers.get("Content-Length", 0)) body = self.rfile.read(length) try: data = json.loads(body) if not isinstance(data, dict) or "reviews" not in data: raise ValueError("Expected JSON object with 'reviews' key") self.feedback_path.write_text(json.dumps(data, indent=2) + "\n") resp = b'{"ok":true}' self.send_response(200) except (json.JSONDecodeError, OSError, ValueError ...[truncated 2462 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: skills/skills/skill-creator/eval-viewer/generate_review.py:286
Finding: Evaluation Viewer Terminates Unrelated Processes Using the Requested Port
Content: View full analysis
None: """Kill any process listening on the given port.""" try: result = subprocess.run( ["lsof", "-ti", f":{port}"], capture_output=True, text=True, timeout=5, ) for pid_str in result.stdout.strip().split("\n"): if pid_str.strip(): try: os.kill(int(pid_str.strip()), signal.SIGTERM) except (ProcessLookupError, ValueError): pass if result.stdout.strip(): time.sleep(0.5) except subprocess.TimeoutExpired: pass except FileNotFoundError: print("Note: lsof not found, cannot check if port is in use", file=sys.stderr) ``` ```python # Kill any existing process on the target port port = args.port _kill_port(port) handler = partial(ReviewHandler, workspace, skill_name, feedback_path, previous, benchmark_path) ``` ### Technical Analysis The viewer resolves every process listening on the requested port and sends it `SIGTERM` without verifying that the process belongs to a prior viewer instance. Starting an evaluation viewer does not require authority to terminate unrelated development servers or user applications. The subprocess invocation itself does not use a shell and the port is parsed as an integer, so command injection is not the issue. The vulnerability is unauthorized process control and failure to respect process ownership at the application level. A user-controlled `--port` argument increases the impact because any same-user process with a known listening port can be targeted. The operating system generally prevents signaling processes owned by other users, b ...[truncated 879 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:48
Finding: Unpinned Third-Party Package Execution in Installation Instructions
Content: View full analysis
Remediation: View remediation
install resume-project ``` 2. Document the expected package publisher and official registry location. 3. Publish and verify package integrity metadata or cryptographic signatures. 4. Review package lifecycle scripts before execution. 5. Use a lockfile where the installation workflow supports it. 6. Recommend running installation in a restricted environment without unnecessary credentials. 7. Avoid commands that automatically execute mutable registry content when an integrity-verified binary or package can be provided. ]]>

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (416)

Description-Behavior Mismatch

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file’s behavior is fundamentally inconsistent with the declared resume-project skill: instead of transforming project descriptions into resume bullets, it scaffolds a React/Vite application, installs dependencies, edits config files, and extracts UI code. This kind of capability mismatch is especially dangerous because users and orchestration systems may invoke the skill expecting harmless text processing, while it performs broad code-generation and system-modifying actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static findings consistently indicate that the declared resume-writing purpose does not match the broader behaviors associated with the skill, including Office document mutation, subprocess execution, MCP connectivity, evaluation tooling, and file/package manipulation. A description-behavior mismatch is dangerous because it defeats user consent and trust: a user invoking a resume helper would not reasonably expect document rewriting, external tool invocation, or broader local-system interactions.
Content: No source excerpt is available for this finding.