setup
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [PERSISTENCE]: The skill writes persistent instructions to
CLAUDE.md. This file is automatically loaded by certain AI agents to define their behavior and project context. The skill uses this to ensure that resume-building workflows and safety constraints (like anti-fabrication rules) are active across all future sessions in the project directory. - [INDIRECT_PROMPT_INJECTION]: The skill sets up a structure where the AI will process external, potentially untrusted data such as existing resumes and project artifacts. This creates an attack surface for indirect prompt injection. The skill mitigates this risk by explicitly writing 'Anti-Fabrication Rules' into the project's instructions, which command the AI to never add, modify, or invent information not present in the verified source YAML file.
- [DATA_EXPOSURE]: The skill generates a scaffold for
resume.yamlthat contains placeholders for sensitive personal information, including phone numbers, emails, and physical locations. This is an expected feature for a resume builder, and the data remains within the user's local project environment.
Audit Metadata