heating the forge...

paramchoudhary_resumeskills

Security risk report for @forgecat/paramchoudhary_resumeskills v0.1.1

Low

Profile sourced from public GitHub repository (Paramchoudhary/ResumeSkills) with MIT license and clear attribution.
No supply-chain poisoning detected; dependencies list is empty, no external package installation or remote payload execution instructed.
Content is educational resume/career guidance with no hidden malicious code or typosquatted dependencies.

Low

Content describes legitimate career-development practices (resume writing, interview prep, job matching) with no instructions to manipulate the AI agent.
No prompt injection, role hijacking, system prompt leakage, or guidance poisoning detected; profile does not instruct the agent to ignore instructions, read credentials, exfiltrate data, or hide its own instructions.
Educational and instructional content is straightforward and transparent; no paraphrased or obfuscated malicious directives.

Details

Findings

Invisible characters detected
skills/job-description-analyzer/SKILL.md · SKILL-011
Invisible characters detected
skills/resume-ats-optimizer/SKILL.md · SKILL-011
Invisible characters detected
platforms/codex/.agents/skills/job-description-analyzer/SKILL.md · SKILL-011
Invisible characters detected
platforms/codex/.agents/skills/resume-ats-optimizer/SKILL.md · SKILL-011
Invisible characters detected
platforms/claude-code/.claude/skills/job-description-analyzer/SKILL.md · SKILL-011
Invisible characters detected
platforms/claude-code/.claude/skills/resume-ats-optimizer/SKILL.md · SKILL-011
Invisible characters detected
platforms/cursor/.cursor/skills/job-description-analyzer/SKILL.md · SKILL-011
Invisible characters detected
platforms/cursor/.cursor/skills/resume-ats-optimizer/SKILL.md · SKILL-011

Evidence

Profile is a collection of skill definitions for resume optimization, cover letter generation, and interview preparation.
Example: 'Resume and career-development agent skills for ATS optimization, resume writing, job matching, interview prep, and job offer decisions.'

Low

No tool definitions or skill hooks declared in the profile; no shell, file_write, file_delete, or high-risk operations requested.
Profile is purely instructional markdown documentation with no executable permissions or authority demands.
Content is read-only guidance for an AI agent to provide career coaching; no excessive agency or unrelated tool access required.

Details

Evidence

Profile metadata shows 'Dependencies: None' and no MCP servers or tool configurations defined.
All content is markdown documentation (README.md, SKILL.md files) with no tool definitions, hooks, or permission requests.
Skills are conceptual (e.g., 'academic-cv-builder', 'interview-prep-generator') with no actual code execution or filesystem access.

Low

No MCP servers defined in the profile; no external binary execution, network access, or filesystem operations configured.
Profile contains only markdown documentation and skill descriptions; no hidden instructions in tool definitions or server configurations.
No unrestricted network access, arbitrary code execution, or credential requirements for MCP integration.

Details

Evidence

Profile metadata explicitly states: 'MCP servers (untrusted data): (none)'
All content is static markdown files with no server definitions, tool binaries, or external integrations.
No environment variables, API endpoints, or external host dependencies declared.