Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward resume-editing skill with no executable code, persistence, credential use, or hidden data movement.
Installers should expect this skill to activate for many resume or job-application-related prompts and to prefer an English structured resume-review format unless the user asks otherwise. It does not appear to run code, access private files, persist settings, or transmit data.
The manifest description says to activate when a user asks to improve, rewrite, review, or tailor a resume or CV, or merely mentions terms like resume/CV/求职. This is broad enough to trigger on general discussion about resumes or job applications, without clear constraints distinguishing when the skill should and should not activate.
The skill is framed around overseas job markets and later mandates a fixed output structure in English-language section headings, but it does not state that the user may choose the output language. Because the trigger set explicitly includes Chinese terms, this can impose a language/locale style without user opt-in.
The listed triggers include broad actions like improve, review, polish, and even simple mention of terms such as "cover letter" or "job application." Without negative examples or scope limits, the skill may activate in situations where the user is discussing application materials rather than requesting this specific resume-optimization behavior.
The file says to 'Always structure the response as' followed by English headings, which hard-codes a language and presentation style. Since the skill may be invoked by users using Chinese terms and does not offer a language choice, this is a natural-language locale policy concern.
No suspicious patterns detected.
