other
- Location
SKILL.md:27- Finding
Misleading Local-Only Privacy Claim Despite Third-Party Résumé Upload Workflow
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:27,SKILL.md:145-150, andSKILL.md:223-227
Vulnerability Type: Privacy Misrepresentation
Risk Level: MediumComplete Relevant Snippets
English translation of
SKILL.md:27:markdown - 🔒 All content is processed locally and will not be uploaded.English translation of
SKILL.md:143-150:markdown Step 5: Kelly generates the following files: 📄 [Name]-resume.json 📕 [Name]-resume.pdf 📝 [Name]-resume-info.md (backup of submitted information) ↓ Step 6: Kelly prompts the user to import the file into aicv.weinuo.workEnglish translation of
SKILL.md:223-227:markdown ## aicv.weinuo.work Import Steps 1. Open https://aicv.weinuo.work 2. Register or sign in, then click "Import" 3. Upload the [Name]-resume.json fileTechnical Analysis
The skill makes an unconditional representation that all content is processed locally and will not be uploaded. Its prescribed workflow subsequently instructs the user to register with an external service and upload the generated résumé JSON.
The uploaded file is designed to contain personally identifiable and professional information, including the user's real name, email address, telephone number, location, employment history, education history, personal summary, and potentially website, certification, language, and project information. The version history identifies the external service as a platform operated by the skill publisher.
Local file generation is not itself an external disclosure, but uploading the generated JSON to the specified website is. The privacy assurance therefore fails to distinguish between the local generation phase and the optional or recommended third-party import phase. This can prevent users from giving informed consent before transferring sensitive information.
No evidence was found that the skill uploads data automatically. Exploitation depends on the user following the documented upload instruct ...[truncated 1472 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the unconditional local-only statement with a phase-specific disclosure, such as: “Résumé generation is performed locally. If you choose to import the generated JSON into aicv.weinuo.work, the résumé data will be uploaded to that external service.”
- Make third-party upload explicitly optional and request informed confirmation immediately before presenting upload instructions.
- Clearly enumerate the data included in the uploaded JSON, including name, email, telephone number, location, employment history, and education history.
- Link to the external service's privacy policy and document its operator, processing purpose, retention period, deletion procedure, security controls, and any onward sharing.
- Provide a fully local workflow for generating and viewing the résumé without requiring registration or external upload.
- Apply data minimization by allowing users to omit unnecessary contact or location details before export.
- Warn users to review the generated JSON before uploading it and provide a redacted export option.
- Keep the privacy statement and workflow synchronized through documentation tests or release-review checks so future destination changes cannot reintroduce contradictory claims.