Trust Assessment
resume-gen received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Unpinned `npx` dependency allows execution of arbitrary code, Skill requires access to `OPENAI_API_KEY`.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unpinned `npx` dependency allows execution of arbitrary code The skill instructs users to run `npx ai-resume` without specifying a version. This means the latest version of the `ai-resume` package will always be downloaded and executed from the npm registry. A malicious actor could publish a compromised version of `ai-resume`, leading to arbitrary code execution on the user's system when the skill is used. Specify a fixed version for the `npx` command, e.g., `npx ai-resume@1.2.3`. Regularly audit and update the pinned version to a known good release. | LLM | SKILL.md:15 | |
| INFO | Skill requires access to `OPENAI_API_KEY` The skill explicitly states that the `ai-resume` tool requires the `OPENAI_API_KEY` environment variable to function. While this is a documented requirement for the tool, it means the underlying `ai-resume` process will have access to this sensitive credential. If the `ai-resume` package itself is compromised (e.g., due to the unpinned dependency risk), this key could be exfiltrated or misused. Ensure the `ai-resume` tool is thoroughly vetted for security. Consider using fine-grained API keys or temporary credentials if available to limit potential damage from compromise. | LLM | SKILL.md:50 |
Scan History
Embed Code
[](https://skillshield.io/report/dc19d779b1d4c6da)
Powered by SkillShield