build-tailored-resume
Pass
Audited by Gen Agent Trust Hub on Apr 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust, multi-stage workflow (Intake, Analysis, Strategy, Tailoring, ATS Check, Render, Validate) that enforces logical sequencing and quality control.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute its own Python-based CLI (
resume-skill) for document rendering. This execution is limited to the skill's verified local package and is used for its primary stated purpose. - [EXTERNAL_DOWNLOADS]: Installation scripts (
install.sh,install.ps1) and the skill instructions involve cloning the repository from GitHub and installing common, well-known Python dependencies (python-docx,lxml). These operations target official package registries and the author's own repository. - [DATA_EXFILTRATION]: The skill utilizes
WebSearchandWebFetchspecifically for researching company context to align resume language with company-specific domain terminology. No patterns of unauthorized data exfiltration or access to sensitive local files were detected. - [INDIRECT_PROMPT_INJECTION]: While the skill processes untrusted user data (resumes and job descriptions), it includes a dedicated 'humanization pass' and a structured validation module (
validate_output.py) to detect and flag placeholder text, banned phrases, and low-quality patterns, effectively mitigating risks associated with untrusted content ingestion.
Audit Metadata