resume-tailor-report
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill reads various local files from the
output/andtemplates/directories, including analysis results, resumes, and configuration state, to aggregate them into a single report. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (AI-generated resumes and job analyses) and interpolates it into a static HTML report.
- Ingestion points: The skill ingests data from
analysis.md,resume.md,opener.md,changelog.md,diagrams.md, andcover-letter.mdlocated in theoutput/directory. - Boundary markers: There are no explicit instructions to use delimiters or boundary markers to isolate the content of these external files within the generated HTML.
- Capability inventory: The skill identifies and reads local files and writes a new static HTML file. It does not possess network exfiltration or subprocess execution capabilities in the provided instructions.
- Sanitization: The instructions do not specify any escaping or sanitization requirements for the Markdown or JSON content before it is rendered as HTML, which could allow malicious scripts embedded in the ingested data to execute in the user's browser context.
Audit Metadata