cv-builder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cv-builder (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
| Field | Required | Notes |
|---|---|---|
| Repo path | Yes (default: .) | Where to scan for background info |
| Job posting / target role | No | Tailors section ordering, emphasis, and keyword match |
| Company name + HQ location | No | Drives regional format detection (Step 0) |
| Output format | No | Auto-detected (see below); override with markdown, latex, or both |
| Output path | No | Default: cv-YYYY-MM-DD.md or cv-YYYY-MM-DD.tex in repo root |
If target role is not given, produce a general-purpose CV.
Run this before any scanning. The result controls format decisions throughout.
1. Is this a remote role?
- "Remote", "fully remote", "distributed", "work from anywhere" in job posting → YES
- No location mentioned or multiple global locations → likely YES
- On-site / hybrid explicitly stated → NO → use regional mode
2. What is the company's primary HQ region?
- Extract from job posting, company name, or user input
- Use the table below to select regional mode
- If remote role at a globally-distributed company → use REMOTE-UNIVERSAL mode| Company HQ / Context | Mode | Key constraints |
|---|---|---|
| Remote-first / globally distributed | REMOTE-UNIVERSAL | 1-2 pages, no photo, no personal data, visa clarity required |
| US / Canada | NA | No photo, no DOB/marital status, 1 page (<5 yrs) or 2 pages |
| UK / Ireland | UK | 2 pages, personal statement at top, no photo |
| Germany / Austria / Switzerland | DACH | Professional photo expected, 2-3 pages, detailed structure |
| Netherlands / Scandinavia | NL-SCAN | English OK, 1-2 pages, no photo, matter-of-fact tone |
| France / Southern Europe | FR-EU | Photo common but optional, 1-2 pages, objective required |
| Singapore / Australia / NZ | APAC-INT | Western-aligned, 2 pages, include work authorization status |
| Japan (multinational) | APAC-INT | Western format for international roles; rikyousho only if local |
| India → international role | NA | Strip traditional Indian fields (photo, DOB, father's name, declaration) |
| Latin America → international | NA | English CV, strip local fields (CPF, marital status, DOB) |
| Gulf / Middle East | GCC | Photo standard, 2-4 pages, nationality + visa status required |
| Africa → international | NA | Compress to 1-2 pages, strip local verbose format |
When in doubt: if the role is remote or the company is a multinational tech firm, default to REMOTE-UNIVERSAL.
State the detected mode to the user before proceeding.
Work authorization: [Country] citizen / [Visa type, expiry if relevant] / open to sponsorship
Run this decision tree before scanning content:
1. Does the repo contain .tex files with CV/resume content?
YES → default output = latex (also produce markdown as secondary)
NO → default output = markdown
2. Did the user explicitly specify a format?
YES → use that, ignore auto-detection result
3. If latex output: is pandoc available? (check: `which pandoc`)
NO → warn user, fall back to markdownWhat counts as a CV/resume .tex file:
cv, resume, curriculum, vitae\section{Experience}, \cventry, \begin{rSection},moderncv, \resumeItem, \resumeSubheading, \CVItem
Always tell the user what was detected and which format will be used before proceeding.
Scan for:
resume.*, cv.*, bio.*, about.*, profile.* — any extension*.md, *.txt, *.tex, *.rst with personal/professional contentCLAUDE.md for identity contextSkip: node_modules/, .git/, vendor/, build artifacts, lock files, binaries
Extract and bucket:
Identity → name, title/headline, location, contact, links (GitHub, LinkedIn, site)
Summary → professional narrative, tagline
Experience → employer, title, dates, responsibilities, outcomes, tech used;
note if roles were remote
Projects → name, description, tech stack, outcomes, links
Skills → languages, tools, platforms, frameworks, domains
Education → institution, degree, dates, notable coursework/thesis
Certifications → name, issuer, date
Publications → optionalDedup: if multiple files have overlapping content, merge and prefer the most specific/recent version.
Infer the appropriate order from the repo content, detected mode, and any target role provided. State which order was chosen and why.
# [Full Name]
[Title / Headline]
[City, Country] · [email] · [github] · [linkedin] · [site]
Work authorization: [status]Include the work authorization line only when it is not obvious — e.g., applying across borders, visa sponsorship needed, or the job posting asks. Omit it otherwise; it wastes space when it adds no information.
Group meaningfully. Only list skills evidenced somewhere in the repo. Categories vary — use what fits the actual background.
**Languages:** Go, TypeScript, Python, Rust, SQL
**Infrastructure:** Kubernetes, OpenTofu/Terraform, Ansible, FluxCD
**Databases:** PostgreSQL, Redis, ClickHouse
**Cloud:** AWS (EKS, RDS, S3, EC2), GCP, Hetzner
**Observability:** Prometheus, Grafana, Loki, OpenTelemetryEvery bullet must follow STAR+Q: Situation context where needed → Task/Action → Result → Quantified metric.
## [Company Name] — [Title]
_[Start Month Year] – [End Month Year or Present]_
- [Strong verb] [what you built/changed] → [outcome with metric]
- [Scope signal: team size, system scale, $ impact, user count]
- [Technical depth: stack decision, architecture constraint, tradeoff navigated]Bullet rules:
%, $, x users, ms, hrs/week, team of N_Jan 2022 – Present · Remote_Only include if they add signal not already in Experience:
## [Project Name]
_[Tech stack]_ · [Link if found]
[1-2 sentences: what it does, why it matters technically, outcome or scale.]## [Institution]
_[Degree], [Field]_ · [Year]Short. No filler. Only notable coursework if directly relevant to target role.
Before finalizing, scan the draft for:
[DATE NEEDED]Run this pass on the full CV draft before writing to disk. Fix in-place.
The CV passes when:
Priority order:
When mirroring: update content only, never restructure the skeleton. Note any structural issues to the user but do not silently fix them.
Filename: cv-YYYY-MM-DD.md
ATS rules (when not mirroring):
## for section headers — no decorative charactersFilename: cv-YYYY-MM-DD.tex
See references/latex-template.md for base template and compilation instructions. Always run pdftotext cv.pdf - | head -80 to verify ATS extraction before submitting.
If source repo has an existing .tex CV, preserve the document class and preamble — only update content sections.
Write both files. Lead with the format that was auto-detected as primary.
After writing:
| Situation | Handling |
|---|---|
| No relevant files found | Ask user to provide their background inline; offer a structured intake interview |
| Only code files, no prose | Infer projects from READMEs; ask for experience context |
| Multiple CV versions | Merge; prefer most recent; flag conflicts |
| Dates ambiguous or missing | Include what's there; mark [DATE NEEDED] |
| LaTeX auto-detected or requested, pandoc unavailable | Produce Markdown only; warn user; explain manual compile |
| Source repo uses a specific LaTeX class (moderncv, etc.) | Preserve class/style; update content only |
| Target role given | Reorder sections; emphasize matching skills |
| No metrics in experience | Note it; write outcome-focused bullets; suggest user add numbers |
| DACH mode triggered | Note that a professional photo placeholder is needed; do not auto-insert |
| India/LATAM → international role | Explicitly strip traditional regional fields (DOB, photo, declaration) and note this to the user |
| GCC mode | Include nationality and visa status fields; flag if not found in repo |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.