resume-intelligence
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several bundled Python scripts (
build_resume_docx.py,build_career_vault.py,inventory_sources.py, etc.) and shell commands likerg(ripgrep) to perform its core functions of file inventory and document generation. These operations are performed locally using internal tools. - [DATA_EXFILTRATION]: The skill is designed to process high-value sensitive data, including personal professional history and enterprise project details from GitHub Enterprise, Jira, and Confluence. It includes extensive safeguards, such as a 'Safe Local-Only Mode' and detailed redaction audit workflows (
references/enterprise-redaction-audit.md), to prevent unintended data exposure. - [PROMPT_INJECTION]: As the skill ingests data from external sources like GitHub pull requests, Jira issues, and LinkedIn content, it possesses an attack surface for indirect prompt injection. The skill mitigates this by using strict boundary markers, confidence scoring for claims, and manual user review gates before including content in final artifacts.
- [SAFE]: All external resources and scripts are provided by the skill author and serve the intended primary purpose of the skill. The project includes high-quality security documentation and best-practice examples for data handling.
Audit Metadata