Resume Email Sender

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:14 AM UTC
• Version: 0.1.0

Overview

The skill mostly matches its resume-email purpose, but it has enough unsafe and misleading email-sending behavior that users should review it before installing.

Review this skill before installing. It can send email from your Gmail account, may tell recruiters a resume is attached when it is not, and handles resume text through unsafe temporary-file and shell-command patterns. Only use it after correcting the attachment language, using safer temp-file handling, and verifying the gog installation source and Gmail permissions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:84

Finding

Shell Command Injection Through User-Controlled Heredoc Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 84–86
Vulnerability Type: Shell command injection through unsafe heredoc generation
Risk Level: High

Vulnerable Code:

bash

cat > /tmp/job_application_email.txt << 'EOF'
[email body here]
EOF

Technical Analysis

The skill directs the agent to insert an email body into a shell heredoc. Although quoting 'EOF' prevents shell expansion inside the heredoc body, it does not prevent an inserted line containing exactly EOF from terminating the heredoc.

The email body may include user-controlled resume or cover-letter content. If that content is interpolated into the displayed shell command without validation, an attacker can terminate the heredoc and place arbitrary shell commands after it. Those commands would be parsed and executed by the shell running the workflow.

For example, malicious resume content could conceptually include a standalone heredoc terminator followed by a command and another heredoc construction. This turns document content into executable shell syntax.

Attack Path

1. An attacker supplies resume, cover-letter, or email-body content containing a line that consists only of EOF.
2. The attacker places shell commands on the following lines.
3. The agent interpolates that content into the documented heredoc command.
4. The injected EOF closes the intended heredoc prematurely.
5. The shell interprets the remaining attacker-controlled lines as commands.
6. Those commands execute with the operating-system privileges and accessible credentials of the agent process.

Impact Assessment

Successful exploitation permits arbitrary local command execution under the account running the skill. The attacker could read or modify files accessible to that account, access environment variables and local credentials, alter the email being sent, invoke authenticated tools such as gog, or establish additional effe ...[truncated 191 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct a shell script by interpolating untrusted email or resume content.
• Use a file-writing API that treats the body strictly as data rather than shell syntax.
• If a subprocess is required, pass the body through standard input using a parameterized process API without shell=true.
• Avoid fixed heredoc delimiters for untrusted multiline content. Merely changing the delimiter to another constant does not eliminate the weakness.
• Keep command arguments in an argument array rather than constructing a single command string.
• Validate the generated message and show the exact final body and recipients to the user before invoking the email tool.
• Add tests containing standalone delimiter lines and shell metacharacters to ensure document content cannot alter command structure.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:82

Finding

Predictable Insecure Temporary File Stores Sensitive Application Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82–93
Vulnerability Type: Unsafe temporary-file handling and plaintext sensitive-data exposure
Risk Level: Medium

Vulnerable Code:

bash

# Write body to temp file (avoids newline issues)
cat > /tmp/job_application_email.txt << 'EOF'
[email body here]
EOF

# Send the email
gog gmail send \
  --to "[e-mail]" \
  --subject "Application for Software Engineer — Jane Smith" \
  --body-file /tmp/job_application_email.txt \
  --account [e-mail]

Technical Analysis

The workflow writes potentially sensitive resume and contact information to the fixed path /tmp/job_application_email.txt. The instructions do not securely create the file, enforce restrictive permissions, verify that the path is a regular file owned by the current user, or delete it after sending.

Shared temporary directories commonly permit other local users to create entries. A predictable path creates race and pre-creation risks. Depending on operating-system protections and account permissions, another local process may be able to observe the file, replace it, or create a symbolic link at that path. The fixed file can also remain on disk after completion, exposing personal information to later processes or users with sufficient access.

Attack Path

1. A local attacker predicts the fixed pathname /tmp/job_application_email.txt.
2. Before the workflow runs, the attacker creates or monitors that path, potentially using a symbolic link where platform permissions allow it.
3. The agent writes the applicant's email, resume, and contact details to the predictable location.
4. The attacker reads the resulting data, causes an unintended file to be overwritten, or races to replace the content before gog reads it.
5. If the content is replaced, the authenticated Gmail command may send attacker-controlled text to the intended recipient.
6. Because n ...[truncated 706 chars]

Remediation

View remediation

Remediation Suggestions

• Create a unique temporary file using mktemp or a secure language-level temporary-file API.
• Set umask 077 before creation so only the current user can read and write the file.
• Open the file atomically with exclusive creation and do not follow symbolic links.
• Verify that the resulting path is a regular file owned by the current user before passing it to gog.
• Register cleanup immediately, such as a shell trap, and remove the file whether sending succeeds or fails.
• Prefer sending the message body through standard input if supported, eliminating the temporary file entirely.
• Avoid storing the resume in the email body unless necessary, and minimize the amount of personal data written to disk.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:128

Finding

Unpinned Third-Party Homebrew Tap Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 128
Vulnerability Type: Unpinned executable dependency from a third-party package source
Risk Level: Medium

Vulnerable Code:

bash

- If `gog` not found: guide user to install with `brew install steipete/tap/gogcli`

Technical Analysis

The skill recommends installing an executable package from a third-party Homebrew tap without pinning a reviewed version or requiring integrity or signature verification. The effective package contents may therefore change after the skill itself has been audited.

This creates a supply-chain trust gap: compromise of the tap, its source repository, release process, or maintainer account could cause users to install altered executable code. The risk is particularly significant because the installed tool is subsequently granted authenticated Gmail access.

This finding does not establish that the named package is malicious. The vulnerability is the workflow's reliance on mutable, unverified third-party installation instructions for a security-sensitive tool.

Attack Path

1. An attacker compromises the third-party tap, associated release infrastructure, or maintainer credentials.
2. The attacker publishes a modified package or formula under the expected package name.
3. A user follows the skill's unpinned brew install instruction.
4. Homebrew retrieves and installs the currently published package rather than a specifically reviewed artifact.
5. The modified executable runs with the installing user's privileges.
6. When Gmail authentication is configured or the tool is used, the compromised executable may access tokens, email content, attachments, and other resources available to that account.

Impact Assessment

A compromised dependency could execute arbitrary code as the installing user and obtain access to local files and credentials available to that user. Because the tool is intended to authentica ...[truncated 363 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specific reviewed release rather than implicitly installing the latest mutable version.
• Document the canonical upstream repository and expected publisher identity.
• Verify release checksums or cryptographic signatures against values distributed through an independently trusted channel.
• Review the Homebrew formula and resolved source artifact before recommending installation.
• Record the reviewed version and digest in the skill documentation.
• Grant only the minimum Gmail scopes required for sending messages.
• Store OAuth credentials using platform-protected credential storage and document how users can revoke access.
• Re-audit the dependency before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill advertises sending resumes as attachments, but the documented implementation only sends a body file and later admits there is no real attachment support. This mismatch can cause users to believe application materials were properly submitted when the resume was never attached, leading to failed or incomplete job applications and unintended disclosure if the resume is pasted inline instead.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation description is broad enough to match many ordinary job-search or resume-related requests, which increases the chance the skill activates in situations where the user only wanted drafting help rather than actual email sending. In a skill capable of transmitting email, overly broad triggers can lead to premature collection of recipient data or an unintended send workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The 'When to Activate' conditions are ambiguous and overlap with general application assistance, especially phrases like 'apply to job' or merely providing a company email. Because this skill can initiate an outbound communication workflow, ambiguous activation raises the risk of unintended email preparation or sending steps being triggered in the wrong context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly tells users to say a resume is attached even though it also states no actual file attachment is sent. This creates deceptive outbound communication and can materially harm the user by sending incomplete applications or misrepresenting what was provided to recruiters.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.