resume-optimizer

Pass

Audited by Gen Agent Trust Hub on Jun 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/generate_resume_pdf.py uses subprocess.check_call to programmatically install the reportlab dependency if it is not found in the environment.
  • [EXTERNAL_DOWNLOADS]: The skill initiates a download of the reportlab package from the Python Package Index (PyPI) during execution.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted user resumes and job descriptions.
  • Ingestion points: User-provided resume text and job descriptions entering the workflow through SKILL.md.
  • Boundary markers: No explicit delimiters or isolation instructions are present to prevent the agent from obeying instructions hidden within user data.
  • Capability inventory: The agent has capabilities for file system write access and script execution via scripts/generate_resume_pdf.py.
  • Sanitization: No validation, sanitization, or filtering of user-provided content is performed before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 19, 2026, 03:42 PM