resume-analyzer
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill workflow involves executing local Python scripts (
scripts/read_pdf.pyandscripts/write_excel.py) via the command line to handle file processing and report generation. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) as it processes untrusted text extracted from user-provided PDF files.
- Ingestion points: The skill uses
scripts/read_pdf.pyto read contents from external PDF resumes provided by the user. - Boundary markers: There are no explicit boundary markers or XML-style tags defined in the instructions to separate the extracted resume text from the agent's internal evaluation logic.
- Capability inventory: The skill possesses the capability to execute shell commands (
python scripts/...) and write files to the local file system (简历分析报告.xlsx). - Sanitization: The skill does not appear to sanitize or filter the extracted text before passing it to the LLM for scoring and analysis.
Audit Metadata