Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Harvard Style CV Creator

v1.0.1

Expert engine for creating Harvard-standard CVs (resumes) and cover letters following the official Harvard Office of Career Services guidelines. Use this ski...

0· 108·0 current·0 all-time
byDavid Escobar@midnightstudioai

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for midnightstudioai/harvard-cv-coverletter.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Harvard Style CV Creator" (midnightstudioai/harvard-cv-coverletter) from ClawHub.
Skill page: https://clawhub.ai/midnightstudioai/harvard-cv-coverletter
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install harvard-cv-coverletter

ClawHub CLI

Package manager switcher

npx clawhub@latest install harvard-cv-coverletter
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill legitimately needs a way to produce .docx files (it references the Node.js 'docx' package). However the registry metadata declares no required binaries or dependencies while SKILL.md and README both say Node.js and the 'docx' package are required. README adds a dependency on a separate 'docx' public skill at /mnt/skills/public/docx/SKILL.md that is not declared nor present in the manifest. These mismatches between stated requirements and actual instructions are incoherent.
!
Instruction Scope
SKILL.md contains explicit shell-style instructions ('npm list -g docx | grep docx || npm install -g docx') instructing the agent/environment to check for and possibly perform a global npm install. The skill also instructs the agent to 'Read references/harvard-rules.md' but the provided file is named harvard-rules.md at the repo root (path mismatch). The skill further claims 'All necessary patterns are included below' but there are no runnable Node scripts in the bundle. These issues mean the SKILL.md both expects to run system commands and relies on files/skills that aren't consistently referenced.
!
Install Mechanism
There is no formal install spec in the registry, yet the instruction text instructs a global npm install if 'docx' is missing. Asking an agent/environment to run 'npm install -g' is a high-impact action (modifies global environment) and is not declared in the skill manifest. README mentions a dependency on a public skill at a platform-specific path, which is another install/runtime assumption not recorded in metadata.
Credentials
The skill does not request any environment variables, credentials, or config paths. There is no evidence it attempts to access secrets. The primary concern is un-declared runtime modification (npm global install), not credential access.
Persistence & Privilege
The skill is not marked 'always' and does not request elevated platform privileges. However, its instructions to perform a global npm install could leave persistent packages on the host, which is a form of lasting system modification. This is a lower-level persistence concern rather than a declared privilege escalation.
What to consider before installing
This skill appears to do what it says (generate Harvard-format .docx resumes/cover letters) but contains inconsistent and potentially risky runtime instructions. Before installing or enabling it: 1) verify you are comfortable allowing the agent/environment to run system commands — the SKILL.md suggests doing a global 'npm install -g docx'; prefer local installs or a bundled implementation instead of global package installs; 2) ask the publisher/source for the missing Node script (there are no code files) and for clarification about the README claim that a public 'docx' skill must exist at /mnt/skills/public/docx/SKILL.md; 3) ask the author to remove or make optional any automatic install steps and to correct file path references (references/harvard-rules.md vs harvard-rules.md); 4) if you cannot confirm the above, avoid allowing the agent to autonomously execute install commands — run any required installs manually in a controlled environment or sandbox first. If you need help drafting a safer installation checklist or a question to send the publisher, I can help.

Like a lobster shell, security has layers — review code before you run it.

latestvk976jvac8ycmxcr9nyhswfc2z5840b1j
108downloads
0stars
2versions
Updated 3w ago
v1.0.1
MIT-0

Harvard CV & Cover Letter Engine

Produces professional, Harvard-standard CVs and cover letters as .docx files.

⚠️ CARDINAL RULE — NO HALLUCINATION

DO NOT hallucinate, create, infer, or assume ANY information about the person's skills, experience, education, achievements, or background. ADHERE STRICTLY AND EXCLUSIVELY to the information explicitly provided by the person in this conversation. If information is missing, ask for it. Never fill in gaps with invented content.

This rule applies to every field: job titles, dates, company names, responsibilities, quantified results, skills, languages, education details — everything. Only use what the user has told you.


Step 0 — Collect Information

Before writing anything, determine what documents are needed and gather the necessary context. Ask only what you don't already have from the conversation.

For CV/Resume, collect:

  1. Contact info: Full name, address (optional), email, phone
  2. Education: Institution(s), degree(s), concentration/major, GPA (optional), graduation date, thesis (optional), relevant coursework (optional), honors/awards (optional)
  3. Experience: For each role — organization name, city/state, job title, dates (Month Year – Month Year), and bullet-point responsibilities/achievements
  4. Leadership & Activities: Organizations, roles, dates, descriptions (optional)
  5. Skills & Interests (optional): Technical skills, languages (with fluency), lab techniques, interests
  6. Format preference: Bullet-style or paragraph-style experience descriptions
  7. Target role or industry (to guide section ordering if needed)

For Cover Letter, collect:

  1. Applicant's contact info: Name, address, email, phone
  2. Date
  3. Recipient: Name, title, organization, address
  4. Position being applied for and where it was found
  5. Organization context: What specifically about this organization excites the person (they must tell you — do NOT invent this)
  6. Key experiences from their background most relevant to this role (drawn only from what they share)
  7. Any specific skills or achievements they want highlighted

If any critical information is missing, ask for it before proceeding. DO NOT hallucinate, create, infer, or assume ANY information to fill gaps.


Step 1 — Select Format

Resume formats:

  • Bullet style (default): Experience described as bullet points starting with action verbs
  • Paragraph style: Experience described in short paragraph form, same action-verb rules apply

Ask the user which they prefer if not specified. Default to bullet style.


Step 2 — Apply Harvard Guidelines

Read references/harvard-rules.md before generating any document. All documents must strictly follow those rules.

Key rules to enforce at all times:

  • Language: specific, active, fact-based, no personal pronouns, no narrative style, no slang
  • Each bullet/sentence begins with an action verb (see action verbs list in the reference)
  • Reverse chronological order within each section
  • Sections ordered by relevance to target role
  • No pictures, age, gender, or references
  • Cover letter: max one page, no flowery language, minimal use of "I"
  • Same font type and size on both resume and cover letter

Step 3 — Generate the Document

Use the docx npm package (v9+) to produce .docx files via a Node.js script. All necessary patterns are included below — this skill is self-contained, no external skill files need to be read.

CV/Resume formatting rules (from Harvard templates):

Header:

[Bold, centered] FirstName LastName
[Centered] Street Address • City, State Zip • email@example.com • phone number

Section headings: Full-width, bold, with a horizontal line underneath (use paragraph border)

Education entry format:

[Bold left] Organization Name          [Right-aligned] City, State
[Left] Degree, Concentration. GPA (optional)    [Right-aligned] Graduation Date
[Left, italic optional] Thesis: ... (optional)
[Left] Relevant Coursework: ... (optional)

Experience entry format:

[Bold left] Organization Name          [Right-aligned] City, State
[Bold left] Position Title             [Right-aligned] Month Year – Month Year
• Bullet starting with action verb, describing accomplishment with quantified results where possible.
• No personal pronouns. Phrase, not full sentence.

Paragraph style alternative for experience:

[Bold left] Organization Name          [Right-aligned] City, State
[Bold left] Position Title             [Right-aligned] Month Year – Month Year
Short paragraph beginning with action verb. No personal pronouns. Avoid articles for flow.

Skills & Interests (optional):

Technical: [list]
Language: [list with fluency levels]
Interests: [list]

Cover Letter formatting rules:

[Date]

[Recipient Name]
[Title]
[Organization]
[Address]

Dear [Name]:

[Opening paragraph — state who you are, position applying for, source of posting, enthusiasm]

[Body paragraph 1 — most relevant experience, specific to the organization's mission]

[Body paragraph 2 — additional experience or skill, quantified where possible]

[Closing paragraph — thank reader, express desire to discuss further]

Sincerely,

[Applicant Name]

Cover letter rules:

  • Address to a specific person whenever possible
  • Max one page
  • Give concrete examples supporting qualifications
  • Use action words throughout
  • Reference the job description and connect to credentials
  • Match font/size to resume

Step 4 — Technical Implementation

Dependency: docx npm package

Check if already installed, install if not:

npm list -g docx 2>/dev/null | grep docx || npm install -g docx

This skill requires docx v9+. No other runtime dependencies beyond Node.js.

Page setup (US Letter, 1-inch margins)

properties: {
  page: {
    size: { width: 12240, height: 15840 },
    margin: { top: 1440, right: 1440, bottom: 1440, left: 1440 }
  }
}

Name header style

new Paragraph({
  alignment: AlignmentType.CENTER,
  children: [new TextRun({ text: "FirstName LastName", bold: true, size: 28, font: "Times New Roman" })]
})

Contact line with bullets

new Paragraph({
  alignment: AlignmentType.CENTER,
  children: [new TextRun({ text: "Address • City, State • email • phone", size: 22, font: "Times New Roman" })]
})

Section heading with border

new Paragraph({
  border: { bottom: { style: BorderStyle.SINGLE, size: 6, color: "000000", space: 1 } },
  spacing: { before: 240, after: 60 },
  children: [new TextRun({ text: "EDUCATION", bold: true, size: 24, font: "Times New Roman" })]
})

Two-column line (org name left, city right) — use tab stops

new Paragraph({
  tabStops: [{ type: TabStopType.RIGHT, position: 9360 }],
  children: [
    new TextRun({ text: "Organization Name", bold: true, size: 22, font: "Times New Roman" }),
    new TextRun({ text: "\t", size: 22 }),
    new TextRun({ text: "City, State", size: 22, font: "Times New Roman" })
  ]
})

Bullets (NEVER use unicode — use numbering config)

numbering: {
  config: [{
    reference: "resume-bullets",
    levels: [{
      level: 0, format: LevelFormat.BULLET, text: "•", alignment: AlignmentType.LEFT,
      style: { paragraph: { indent: { left: 360, hanging: 360 } } }
    }]
  }]
}
// Then in paragraphs:
new Paragraph({
  numbering: { reference: "resume-bullets", level: 0 },
  children: [new TextRun({ text: "Action verb + achievement.", size: 22, font: "Times New Roman" })]
})

Step 5 — Output

  1. Generate the .docx file(s) to /home/claude/ first
  2. Validate by opening the file in Word or running: python /mnt/skills/public/docx/scripts/office/validate.py output.docx (only if that path exists in the environment; skip otherwise)
  3. Copy final file to /mnt/user-data/outputs/
  4. Present files to user with present_files
  5. Remind the user to review all content for accuracy — verify dates, titles, and wording

⚠️ FINAL REMINDER — NO HALLUCINATION

DO NOT hallucinate, create, infer, or assume ANY information about the person's skills, experience, education, achievements, or background. If something wasn't explicitly stated by the person, do not include it. Ask if you need more information.

Comments

Loading comments...