k2f-resume
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data such as career history notes, LinkedIn exports, and existing CVs to generate resume content.\n
- Ingestion points: Career history, notes, existing CVs, and LinkedIn exports provided by the user (SKILL.md).\n
- Boundary markers: No specific delimiters or instructions to ignore embedded commands are defined for the input processing.\n
- Capability inventory: The skill is capable of installing additional skills (
npx skills add) and creating/packaging files (content_and_design.md,.K2Fpackages).\n - Sanitization: No sanitization or validation of the input content is described.\n- [EXTERNAL_DOWNLOADS]: The skill requires the installation of a secondary skill (
suzheng/k2f) to complete the resume generation process.\n - Evidence:
npx skills add suzheng/k2f --skill k2fin SKILL.md.\n - Context: This dependency is provided by the same author (suzheng) as the primary skill.
Audit Metadata