Security audit
Security checks for vulnerabilities and agentic risk
This resume-building skill is coherent and purpose-aligned, with no evidence of hidden data access, persistence, exfiltration, or unsafe automatic behavior.
Before installing, expect the skill to handle personal resume details locally and write resume outputs to the chosen output directory. Review generated files before sharing them, and note that this package may be incomplete because the renderer expects a missing Typst template file.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Success requires `resume.pdf` to exist.
## Output Rules
- Return a concise summary of what was generated.
- State the output file paths clearly.
The skill requires shell execution (python3, typst) and file read/write behavior but does not declare an explicit tool/permission scope. That creates an overbroad execution surface where an agent or runtime may grant more capability than intended, increasing the risk of unsafe file access or command execution through downstream inputs or implementation details.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
shutil.copyfile(template_path, typ_path)
cmd = ["typst", "compile", str(typ_path), str(pdf_path)]
result = subprocess.run(cmd, capture_output=True, text=True)
if result.returncode != 0:
if pdf_path.exists():
pdf_path.unlink()
No suspicious patterns detected.