career-role-finder
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements strict integrity boundaries via a 'no-fabrication' policy, which explicitly prohibits the creation of fictitious employers, job titles, metrics, or URLs. This serves as a significant security and quality control.
- [EXTERNAL_DOWNLOADS]: The skill is designed to fetch real-time hiring data from well-known career platforms (e.g., LinkedIn, Boss Zhipin, Nowcoder) and official company career portals using web search and fetching tools.
- [DATA_EXFILTRATION]: User-provided profile details (such as skills, experience, and location) are transmitted to established search engines and recruitment platforms to identify relevant job opportunities. This data usage is transparent and essential to the skill's functionality.
- [PROMPT_INJECTION]: The skill processes untrusted content from external job descriptions, presenting a surface for indirect prompt injection. However, the risk is mitigated by the skill's limited capabilities and strict output validation rules.
- Ingestion points: External job description text retrieved from web URLs via WebFetch.
- Boundary markers: While specific delimiters are not mentioned in the prompt, the agent is governed by an 'Integrity Gate' to verify results against search data.
- Capability inventory: The skill uses WebSearch and WebFetch; it lacks commands for code execution or sensitive local file access.
- Sanitization: No explicit sanitization of external text is described, but the agent is instructed to report failures if content cannot be reliably retrieved.
Audit Metadata