resume-tailoring
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation includes installation instructions that reference an external GitHub repository (
varunr89/resume-tailoring-skill) via thenpxcommand. - [PROMPT_INJECTION]: The skill is designed to process untrusted external data (resumes and job descriptions), which presents a surface for indirect prompt injection attacks.
- Ingestion points: User-provided resume and job description content in
SKILL.md(/tailorand/batchcommands). - Boundary markers: The instructions lack explicit delimiters or markers to isolate user-supplied data from the agent's instructions.
- Capability inventory: The skill body does not define or request dangerous capabilities such as file system modifications, network requests, or shell command execution beyond the provided text-processing logic.
- Sanitization: No sanitization, validation, or escaping logic for the ingested content is specified.
Audit Metadata