resume-tailor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited resume-tailor (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate a per-company tailored resume using Gemini 2.5 Flash via resume_tailor.py.
For a single job, run resume_tailor.py with the job posting URL and company name as arguments.
For batch mode (all companies with status done and non-LinkedIn links in the tracker), run it with no arguments.
Saved to the resume_adjusted/ folder configured in config.py, named resume_{CompanyName}.docx. The script skips a company if the file already exists — delete the file to regenerate it.
Fetches the job description from the URL, reads the base resume, and asks Gemini to suggest minimal tweaks — reordering skills, surfacing existing keywords. It never fabricates experience. Gemini's markdown formatting (**bold**) is stripped automatically before writing to the DOCX.
Most standard job pages work. Workday works via JSON-LD extraction. Ashby and internal portals (like BPCE) may fail — in that case, skip the URL and tailor manually, or paste the job description text into a temp file and adjust the call.
LinkedIn URLs are skipped automatically in batch mode.
The free Gemini tier occasionally returns 429 errors — the script retries automatically. If it keeps failing, wait a minute and re-run. Use gemini-2.5-flash, not gemini-2.0-flash (that quota runs out faster).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.