Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

JD Resume Tailor

v1.1.0

Generate job-specific tailored resumes from a base profile and job description. First collects structured user info (personal details, work history, side pro...

0· 116·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for 26048608982lp-ai/jd-resume-tailor.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "JD Resume Tailor" (26048608982lp-ai/jd-resume-tailor) from ClawHub.
Skill page: https://clawhub.ai/26048608982lp-ai/jd-resume-tailor
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install jd-resume-tailor

ClawHub CLI

Package manager switcher

npx clawhub@latest install jd-resume-tailor
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The declared purpose (generate tailored HTML/PDF resumes) matches the instructions for collecting a profile and producing HTML. However, the SKILL.md explicitly requires a headless browser (Edge/Chrome) for PDF export and accepts URLs as JD input, yet the registry metadata lists no required binaries and states "No network requests" in the security header. These contradictions mean the declared requirements do not align with what the skill actually needs to run.
!
Instruction Scope
Most runtime instructions stay within resume-building scope (collect PII, write profile and outputs under workspace/resumes/, parse JD, generate HTML). Concerns: SKILL.md says "No network requests" but also accepts JD via URL (web_fetch) — that's inconsistent. The skill also includes explicit PowerShell commands to run local browser executables for headless PDF export, which is an operation outside the purely text-processing part of the skill and should be declared as a required binary. File read/write is constrained to workspace/resumes/, which is reasonable, but the acceptance of URLs implies network I/O that isn't accounted for or explained.
!
Install Mechanism
There is no install spec (instruction-only), which minimizes disk-level risk. However, the skill expects platform binaries (msedge/chrome) to be present and provides exact PowerShell command lines for headless PDF export. Because these tools are essential for the advertised auto-export feature but are not declared as required binaries or installation steps, the metadata is incomplete and incoherent.
Credentials
The skill requests no environment variables or external credentials, which is proportionate to its purpose. It does request a lot of personal data (name, contact, birth date, gender, etc.) — expected for resume generation but sensitive. The instructions say to store profile and output files in workspace/resumes/, which is a limited scope; users should be aware this will create files containing PII in their workspace.
Persistence & Privilege
The skill does not request always:true or any system-wide privileges. It is user-invocable and can be called autonomously (platform default), which is expected. The skill writes only to its workspace-resumes/ area per instructions; it does not declare modifying other skills or system settings.
What to consider before installing
This skill seems to do what it claims (collect a profile and produce a tailored HTML/PDF resume), but there are important mismatches you should address before trusting it with real data: - Metadata vs instructions mismatch: The SKILL.md expects a headless browser (Edge/Chrome) and also accepts JD URLs, but the registry entry lists no required binaries and says "No network requests." Confirm whether the skill will access the network and whether it will run local browser executables. If network fetches are allowed, decide if you trust the agent to fetch arbitrary URLs. - PII storage: The skill saves resume-profile.md and outputs under workspace/resumes/. These files will contain sensitive personal data (contact info, birth date, etc.). Ensure you are comfortable storing that data in your workspace and that backups or sync won't leak it. - Execution behavior: The skill includes exact PowerShell commands to launch browsers in headless mode. If you install this, verify (in a safe environment) that the agent only invokes local browsers to render the HTML and does not pass data to external services. If you don't want automatic PDF export, ask the skill/agent to only generate HTML and not run the headless commands. - Minimal testing: Before providing your real resume data, test the skill with dummy data to observe whether it attempts unexpected network access or runs commands you didn't intend. - Suggested fixes for the publisher: declare required binaries (msedge/chrome) or provide an install spec; clarify whether URL input will cause outbound network requests; and document where files are written and how long they persist. Given these inconsistencies, treat the skill as suspicious until the author clarifies the network and binary requirements and you confirm the run behavior in a controlled test.

Like a lobster shell, security has layers — review code before you run it.

chinesevk974c2y5mrtkg57rhz918c81ds83sfkcjd-matchvk974c2y5mrtkg57rhz918c81ds83sfkcjob-searchvk974c2y5mrtkg57rhz918c81ds83sfkclatestvk974c2y5mrtkg57rhz918c81ds83sfkcresumevk974c2y5mrtkg57rhz918c81ds83sfkc
116downloads
0stars
3versions
Updated 1mo ago
v1.1.0
MIT-0

Resume Tailor

Generate a polished, job-specific HTML resume. Two-phase workflow: collect profile → match JD.

Phase 1: Profile Collection

On first run (no base profile exists), collect user info in this structured order. Ask one section at a time, confirm before moving to next. Save completed profile to resume-profile.md in workspace.

Before collecting, confirm preferences:

  1. Accent color — Ask user to pick a theme color (default: #6b4c9a purple). Accept hex, color name, or "default". This applies to all generated resumes unless overridden per-JD.
  2. Language — Chinese (中文) or English resume? Default based on user's communication language.
  3. Target region/culture — e.g., mainland China (include birth date, photo slot), overseas (exclude).

1.1 Personal Information (个人信息)

  • Name, phone, email, birth date, location, gender
  • LinkedIn / portfolio URL (optional)

1.2 Education (教育背景)

  • School, degree, major, graduation date
  • Core courses / GPA / honors (optional, include if relevant to target)

1.3 Work Experience (工作经历)

For each role, collect:

  • Company name, location
  • Role / title
  • Project name and type (if applicable)
  • Date range (start - end)
  • 3-6 bullet points of responsibilities and achievements
  • Prompt user to quantify where possible (numbers, percentages, metrics)
  • Ask: "Any tools, tech, or methods worth mentioning?"

1.4 Side Projects / Personal Projects (个人项目)

For each project:

  • Project name, type (game, web app, tool, etc.)
  • Status (launched / in progress / prototype)
  • Your role and contribution
  • Key features and metrics (DAU, retention, revenue, etc.)
  • Tech stack used
  • If built with AI tools, note which and how

1.5 Skills (技能)

Group into categories:

  • Domain skills: e.g., game design, numerical balance, UX research
  • Technical tools: e.g., Excel/VBA, Python, Claude Code, Cursor
  • Languages: Chinese, English, etc. with proficiency level

1.6 Certificates & Awards (证书 & 荣誉)

  • Professional certifications
  • Academic awards / competitions

1.7 Save Profile

After collecting all sections, save as resume-profile.md:

# Resume Profile: [Name]
> Last updated: YYYY-MM-DD

## Personal
[structured data]

## Education
[structured data]

## Work Experience
[per-role structured data with bullets]

## Projects
[per-project structured data]

## Skills
[categorized list]

## Certificates
[list]

On subsequent runs, read resume-profile.md first. Ask only: "Profile loaded. Anything to update?" If changes needed, edit specific sections.

Phase 2: JD Match & Resume Generation

2.1 Collect Job Description

Always ask the user to provide the JD. Accept via:

  • Pasted text (most common)
  • File path (txt/md/pdf/html)
  • URL (web_fetch)

After reading the JD, confirm with user:

📋 JD确认:
- 岗位:[Job Title]
- 公司:[Company]
- 核心要求:[3-5 key requirements]
- 加分项:[preferred qualifications]

以上提取正确吗?有补充或修正吗?

Only proceed after user confirms the JD parsing is correct.

2.2 Match Analysis (show to user before generating)

🎯 Target: [Job Title] at [Company]
📊 Match: [High/Medium/Low]

✅ Strong matches:
- [match 1: profile strength → JD requirement]
- [match 2]
- [match 3]

⚠️ Gaps (be honest):
- [gap 1: JD wants X, profile has limited Y]
- [gap 2]

📝 Tailoring strategy:
- Emphasize: [what to highlight and expand]
- Reframe: [how to position existing experience]
- Downplay: [what to shorten or combine]

🎨 Accent color: [using default / user's choice / suggest per JD tone]

Wait for user confirmation or adjustments before generating.

2.3 Generate HTML Resume

Produce a single self-contained HTML file with all CSS inline. Reference references/html-template-guide.md for detailed template specs.

Content rules:

  • 3 core advantages in top highlight grid — each mapped to a top JD priority
  • Work experience ordered by relevance to JD (most relevant first)
  • Expand descriptions for matching roles; condense irrelevant ones
  • Mirror JD keywords naturally (don't keyword-stuff)
  • Every bullet point quantified where possible
  • Skills section prioritizes JD-required skills
  • 1-2 pages max for A4

Style defaults (overridable per user preference):

  • Accent: #6b4c9a (purple) — ask user on first run, store in profile
  • Font: "Microsoft YaHei", "PingFang SC", sans-serif (Chinese) or "Inter", sans-serif (English)
  • Name: 26px, section titles: 13px, body: 9-11px
  • Print CSS: @media print { print-color-adjust: exact; }
  • A4: 210mm width, @page { margin: 0; }

2.4 Auto Export PDF

After saving the HTML file, automatically export to PDF using headless browser.

Edge (preferred, Windows built-in):

& "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --print-to-pdf="$outputPath" --no-margins --disable-gpu "$htmlPath"

Chrome fallback:

& "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --print-to-pdf="$outputPath" --no-margins --disable-gpu "$htmlPath"

Rules:

  • Output PDF named [Name]-[JobTitle].pdf in same resumes/ directory
  • Use --no-margins since the HTML template handles its own padding
  • Wait for the process to complete before proceeding
  • If headless export fails, tell user to manually open HTML in browser and Ctrl+P

2.5 Deliver Result

Save both files to resumes/:

  • [Name]-[JobTitle].html
  • [Name]-[JobTitle].pdf

Tell user:

✅ Resume generated! PDF saved to resumes/[Name]-[JobTitle].pdf

Verify before sending:

  • Contact info correct
  • Dates accurate
  • No typos in company/project names
  • Achievements not overstated
  • PDF formatting looks correct (open and scroll through)

File Structure

workspace/
├── resume-profile.md          # Base profile (created on first run)
├── resumes/
│   ├── [Name]-[JobTitle].html
│   ├── [Name]-[JobTitle].pdf
│   └── ...
└── skills/
    └── resume-tailor/
        ├── SKILL.md
        └── references/
            └── html-template-guide.md

See references/html-template-guide.md for the complete HTML template structure with all sections, CSS classes, and print optimization details.

Comments

Loading comments...