tailor-resume

Pass

Audited by Gen Agent Trust Hub on Jun 30, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill implements a secure local data management strategy, storing user resumes and work history in a dedicated .proficiently directory. This practice ensures data persistence while maintaining user privacy.
  • [PROMPT_INJECTION]: The skill processes external content from job posting URLs provided by the user. While this creates a potential surface for indirect prompt injection, the risk is mitigated by strict instructions that require the agent to verify all information against the user's original resume and work history profile.
  • Ingestion points: Job descriptions are fetched from external URLs via browser MCP tools as described in references/browser-setup.md.
  • Boundary markers: The scripts/tailor-resume.md file contains non-negotiable "Strict Accuracy Rules" and "Quality Checks" to prevent the inclusion of fabricated data.
  • Capability inventory: The skill can perform local file writes to save tailored resumes and use browser tools for data extraction.
  • Sanitization: A mandatory "Critique and Rewrite" phase is used to filter out AI-generated filler and ensure the content remains factual.
  • [SAFE]: The skill utilizes standard browser MCP tools (e.g., tabs_context_mcp, get_page_text) to interact with job postings. The documentation in references/browser-setup.md provides guidance on safe tool usage to avoid context window exhaustion.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 30, 2026, 05:33 PM
Security Audit — agent-trust-hub — tailor-resume