resume-tailor
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust "Hard Gate" for truth-preservation, requiring the agent to use verification scripts (verify_no_fabrication.py) and obtain explicit user confirmation for any new factual claims, which effectively mitigates accidental fabrication or hallucination.
- [EXTERNAL_DOWNLOADS]: The skill uses WebFetch to retrieve job descriptions from URLs provided by the user. This is a core function for tailoring resumes and is performed on-demand without suspicious automated background activity.
- [COMMAND_EXECUTION]: The test suite (tests/test_verify_no_fabrication.py) uses subprocess.run to verify the command-line interface of the included Python scripts. This is standard development practice and is scoped to local execution of the skill's own scripts.
- [DATA_EXFILTRATION]: No patterns of sensitive data exfiltration or unauthorized network communication were found. The skill operates on user-provided resume and job description data within the defined workspace.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from job descriptions via WebFetch (Ingestion points: job posting URL in SKILL.md). It uses a mandatory human-in-the-loop verification process where scripts compare proposed output against the original resume to detect new claims (Sanitization). The agent is instructed to require user confirmation for all flagged items before using its file-write capabilities (Boundary markers/Capability inventory).
Audit Metadata