tailor-resume
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a secure local data management strategy, storing user resumes and work history in a dedicated
.proficientlydirectory. This practice ensures data persistence while maintaining user privacy. - [PROMPT_INJECTION]: The skill processes external content from job posting URLs provided by the user. While this creates a potential surface for indirect prompt injection, the risk is mitigated by strict instructions that require the agent to verify all information against the user's original resume and work history profile.
- Ingestion points: Job descriptions are fetched from external URLs via browser MCP tools as described in
references/browser-setup.md. - Boundary markers: The
scripts/tailor-resume.mdfile contains non-negotiable "Strict Accuracy Rules" and "Quality Checks" to prevent the inclusion of fabricated data. - Capability inventory: The skill can perform local file writes to save tailored resumes and use browser tools for data extraction.
- Sanitization: A mandatory "Critique and Rewrite" phase is used to filter out AI-generated filler and ensure the content remains factual.
- [SAFE]: The skill utilizes standard browser MCP tools (e.g.,
tabs_context_mcp,get_page_text) to interact with job postings. The documentation inreferences/browser-setup.mdprovides guidance on safe tool usage to avoid context window exhaustion.
Audit Metadata