glmv-resume-screen
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes resumes that may contain malicious text designed to trick the model into providing a biased evaluation.
- Ingestion points: Resume data is ingested from remote URLs and local PDF files within
scripts/resume_screen.py. - Boundary markers: The prompt template in
scripts/resume_screen.pydoes not utilize robust delimiters or specific instructions to ensure the model ignores embedded commands within the resume content. - Capability inventory: The script can read local files, communicate with the Zhipu API, and save output to the local filesystem.
- Sanitization: No input validation or safety filtering is performed on the content of the resumes before they are submitted to the AI model.
- [EXTERNAL_DOWNLOADS]: The skill allows for the processing of resume files from external URLs provided by the user, which are subsequently handled by the Zhipu model API.
Audit Metadata