build-tailored-resume

Pass

Audited by Gen Agent Trust Hub on Apr 24, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill implements a robust, multi-stage workflow (Intake, Analysis, Strategy, Tailoring, ATS Check, Render, Validate) that enforces logical sequencing and quality control.
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute its own Python-based CLI (resume-skill) for document rendering. This execution is limited to the skill's verified local package and is used for its primary stated purpose.
  • [EXTERNAL_DOWNLOADS]: Installation scripts (install.sh, install.ps1) and the skill instructions involve cloning the repository from GitHub and installing common, well-known Python dependencies (python-docx, lxml). These operations target official package registries and the author's own repository.
  • [DATA_EXFILTRATION]: The skill utilizes WebSearch and WebFetch specifically for researching company context to align resume language with company-specific domain terminology. No patterns of unauthorized data exfiltration or access to sensitive local files were detected.
  • [INDIRECT_PROMPT_INJECTION]: While the skill processes untrusted user data (resumes and job descriptions), it includes a dedicated 'humanization pass' and a structured validation module (validate_output.py) to detect and flag placeholder text, banned phrases, and low-quality patterns, effectively mitigating risks associated with untrusted content ingestion.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 24, 2026, 04:54 PM
Security Audit — agent-trust-hub — build-tailored-resume