cv-claw-6eced2 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cv-claw-6eced2 (Agent Skill) and scored it 79/100 (yellow). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 5 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 5 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
cv-claw is a CLI tool that manages resumes as structured JSON and renders them to HTML via Jinja2 templates.
One skill, four resume tasks. Read the matching reference file for the user's request, then follow it.
| User wants to… | Read this reference |
|---|---|
| Convert a PDF / image / pasted resume into cv-claw JSON | references/ingest.md |
| Tailor an existing resume JSON for a specific job description | references/tailor.md |
| Tweak how the current rendered resume looks ("make X bigger", "move X") | references/tweak-template.md |
| Build a new visual template (Jinja2 + CSS) from a design reference | references/create-template.md |
All four tasks consume the same schema — references/schema.md. Each task reference points to it; you don't need to read it preemptively.
Tweak vs. create. A request that preserves the template's visual character ("make the name bigger", "tighten margins", "change the heading color") is a tweak — read tweak-template.md. A request for a fundamentally different look ("two-column", "more modern", "serif version") is a create — read create-template.md. When uncertain, ask the user.
uv add cv-claw or pip install cv-claw).discover the user's preferred directory from workspace CLAUDE.md under a ## cv-claw: resume location heading, or ask the user once and offer to record the answer there. Never assume resumes/.
classic). Read-only../.cvclaw/templates/<name>/. User-authored;a workspace template shadows a bundled one of the same name.
cv-claw render <json> writes <json>.html next to theinput by default. --output-dir <dir> redirects HTML output; -o <path> overrides to a single file.
cv-claw validate <json>.<!-- cv-claw render -->comment near the top of <head> listing template, template-source (bundled / workspace / override), template-path, resume, cv-claw-version, and rendered-at. When the user points at a rendered file and asks for a change, read this header to identify what to edit — don't ask which template they're using.
cv-claw eject <name>) copies a bundled template into./.cvclaw/templates/<name>/ so it can be edited in place. Used silently by the tweak flow; users do not need to learn the term.
faithfully from the source.
prose,keyvalue, list, timeline) are fixed; map novel layouts onto them.
alongside it (same directory, suffix the filename with the target slug).
location from CLAUDE.md or by asking.
<root>/<name>/<name>.html.j2 across the workspace and bundled roots.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.