More screenshots

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    Resumelock: resume uploads to profiles, no made-up skills

    1

    Checks each PDF or DOCX upload, stores it in a private bucket and extracts a schema-locked draft where every skill and role needs a quote found in the text. The user confirms it; raw files are deleted on a schedule.

    $19

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Resumelock: resume uploads to profiles, no made-up skills

    Resumelock: resume uploads to profiles, no made-up skills

    Example session with this skill installed

    Resumelock: our Next.js app on Supabase takes CV uploads for job matching. Set up the upload-to-profile pipeline and run it against the synthetic fixtures.

    • Read your context and instructions
    • Compiled the resumelock

    Pipeline set up in the example project (fictional CVs, @example.com addresses).

    Fixture run: 6 synthetic CVs

    FixtureResultItems keptDropped (no evidence)
    One-column PDFparsed141
    Two-column PDFparsed110
    DOCX with tablesparsed92
    Scanned PDFrejected: 112 chars, asked for a text PDF00
    Hidden white text injectionparsed81 ("Kubernetes")
    No skills sectionparsed50

    Total dropped: 4, logged as counts only.

    Done when

    • Bucket resumes private, 5 MB, PDF or DOCX only; a second test account is denied another user's folder
    • Magic-byte check rejects a renamed .exe and an encrypted PDF
    • Every stored skill and role has evidence found in the extracted text
    • Profile schema has no salary, DOB, ID or photo field
    • Injection fixture produces zero extra items
    • Grep of the test run logs: no resume text or filenames
    • Pruner scheduled (30-day retention); first run not yet observed
    • Fixtures are synthetic only

    Next steps

    • Watch the first pruner run and confirm it deletes files past retention.
    • Test account deletion removes the file, profile and derived rows.
    • State the 30-day retention in the privacy notice.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Resume uploads go wrong in two ways at once. The parser adds skills the person never wrote, and the files themselves end up in a public bucket or in plain text inside your logs. Resumelock turns each PDF or DOCX upload into a profile the user confirms, where every skill and role points back to a quote that really appears in the document.

    What it does

    • Locked contract: PDF and DOCX only, 5 MB max, a JSON Resume-like schema with no salary, date of birth, ID number, photo, religion or marital status field.
    • Private storage: a private resumes bucket with size and MIME limits, per-user folder RLS and signed upload URLs straight to Storage.
    • File checks: byte size and magic bytes verified with file-type; encrypted PDFs and files over 10 pages are rejected.
    • Evidence per item: every skill, role and certificate carries a quote, and code keeps it only if that quote is found in the extracted text. Failures are dropped and counted.
    • User confirmation: only profiles marked confirmed_at feed matching or CV tailoring.
    • Retention: raw files are deleted after confirmation or after 30 days by default, through the Storage API.

    How it works

    1. Upload and validate: signed upload URL, then size and magic-byte checks on the server.
    2. Extract text: unpdf for PDF, mammoth for DOCX; under about 200 characters means a scan.
    3. Schema-locked extraction: CV text labelled as untrusted data, no tools for the model.
    4. Evidence check and confirm: substring check in code, then the user confirms.
    5. Hygiene: logs carry counts only, a pruner deletes old files, synthetic fixtures prove it.

    Frameworks & tools

    Supabase Storage with RLS, Next.js on Vercel, unpdf, mammoth, file-type, zod and Vitest.

    Why this beats prompting it yourself

    Asking a model to "extract skills from this CV" returns whatever it infers, including tools copied from a job post or hidden prompt text. Here the keep-or-drop decision is code, the schema has no field for sensitive data, and a hidden-text injection fixture must add zero items before release.

    Use cases

    • Job search apps turning a CV into a profile for matching.
    • Recruiting tools, training intake and scholarship forms.

    Known limitations

    Not for general OCR of scanned forms, for writing the tailored CV, or for bulk imports of other people's CVs without consent. Scanned CVs need the OCR variant with per-item confirmation. Steps are written for Supabase Storage and a Next.js server, so other stacks need their equivalents.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scanned

    Verified clean 1 day ago

    • Passed all security checks, Safe to install

    Requires

    Supabase Storage
    Next.js
    unpdf
    mammoth
    file-type
    zod
    Vitest

    Listed1 day ago

    What's inside

    Frequently Asked Questions