UseResume
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's requirements and instructions match its stated purpose (a CLI wrapper for useresume.ai) and request only the expected API key and binary; the only notable risk is the usual npm package/supply-chain risk from installing @useresume/cli.
This skill appears coherent: it simply invokes the useresume.ai CLI and requires a USERESUME_API_KEY. Before installing, verify the npm package @useresume/cli is the official package (check the publisher, package page, repository link, recent versions and reviews). Prefer installing in a confined environment (non-root or container) if you have supply-chain concerns. After installing, run 'useresume credentials:test' to confirm the API key operates as expected. Only provide an API key whose scope/access you trust (avoid sharing broad/long-lived credentials if possible).
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.