resume-tailor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited resume-tailor (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Tailors the current CV DOCX for one job using cv_tailor.py. Claude does the comparison and asks the user which missing skills they really have; the script applies the edits and exports a PDF (the temporary DOCX is deleted). No Gemini call, so it uses none of the 20/day free quota.
Several postings at once (user gives 2+ URLs): use the batch flow below instead of repeating the steps per job.
python cv_tailor.py jds <scratchpad>/jds <url1> <url2> ... fetches all JDs in parallel intojd_1.txt, jd_2.txt, ... (input order). For any line marked FAILED, open the page in the browser or ask the user to paste it.
cv, and the AI CV with BASE_CV_DOCX=... if any posting is AI-focused).skills across postings and ask each skill once (a confirmed skill counts for every job that needs it).
<scratchpad>/batch.json:[{"company": "Acme Backend", "base": "main", "edits": {"replace": [...], "add_skills": [...]}}, ...] base is main (BASE_CV_DOCX) or ai (BASE_CV_DOCX_AI). Use a distinct company per posting (e.g. company + role) so the PDFs don't overwrite each other.
python cv_tailor.py apply-batch <scratchpad>/batch.json (optional --workers N, default 3).All edits are checked before any PDF is made; PDFs export in parallel, one Word instance per worker.
python cv_tailor.py jd "<url>". Any job link works: LinkedIn,Welcome to the Jungle, Ashby and Greenhouse use the site's own data for a clean description; other sites (company career pages, Workday, etc.) fall back to reading the page. If it fails (login walls, closed jobs), ask the user to paste the description.
python cv_tailor.py cv (prints each paragraph of the base CV DOCX).multiSelect: true: up to 4 questions of upto 4 missing skills each, mandatory JD skills first. Question text like "Which of these have you used in real work?". The user can type extra detail in "Other" (e.g. the tool they used). If a confirmed skill needs context to be described honestly (where/how), ask a short follow-up.
{"replace": [{"old": "...", "new": "..."}], "add_skills": ["..."]}. Each old must sit inside ONE run of the DOCX. Bold highlights are separate runs, so keep each edit within a plain or a bold segment of the paragraph text from step 2.
python cv_tailor.py apply "<Company>" <edits.json>.apply (shown as removed -> added), the confirmed skills added, the page count,the JD skills still missing, and the output paths.
word "fintech" in the SMARTS bullet. No "| Fintech" in the title line.
Frameworks & Tools: line via add_skills, not into a specificjob's bullet, unless the user said where they used it.
apply(CV_ALWAYS_AI_SKILLS in config.py; AI & Upskilling: on the main CV, AI & LLM: on the AI CV). Don't put it in add_skills or a replace yourself. Mention it in the step 7 report.
apply also runs CV_AI_DEFAULT_REPLACE from config.py (adds the weekly HR agent to thejob-search project bullet). Don't repeat it in your edits; mention it in the report.
resume_adjusted\resume_<company>.pdf only (folder from RESUME_OUTPUT_DIR in config.py). An existing file with the same name is overwritten.
Base CV: BASE_CV_DOCX in config.py (override with BASE_CV_DOCX in config.py). PDF export needs Microsoft Word.
AI-focused roles ("use AI resume"): prefix both cv and apply with the env var BASE_CV_DOCX="<path>", where <path> is BASE_CV_DOCX_AI in config.py. It has an AI & LLM: skills line; put confirmed AI skills there with a replace, not add_skills.
resume_tailor.py (Gemini, batch from tracker) targets the OLD CV layout (fixed paragraph numbers) and a PDF base path, so it does not work with the current CV. Use the steps above.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.