career-jd-analyzer
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is designed to fetch and process job descriptions from external, untrusted web sources using the
WebFetchtool.\n - Ingestion points: External job content is retrieved from URLs in
SKILL.md(Step 1).\n - Boundary markers: While it tags sources, it lacks robust boundary delimiters to separate untrusted content from the agent's internal instructions.\n
- Capability inventory: The skill utilizes network access (
WebFetch) and passes extracted data to downstream skills in the 'career-skills' pack.\n - Sanitization: No explicit sanitization or filtering of the fetched web content is performed before processing.\n- [EXTERNAL_DOWNLOADS]: Uses the
WebFetchtool to retrieve data from well-known job platforms like Boss Zhipin, LinkedIn, and Nowcoder to perform its core analysis tasks.\n- [COMMAND_EXECUTION]: The README provides a standard installation command usingnpxto add the skill to the agent environment.
Audit Metadata