cover-letter

Pass

Audited by Gen Agent Trust Hub on May 1, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute a curl command targeting localhost:8791. This is used to synchronize application status with a local job-tracking service and does not involve external network exfiltration.- [PROMPT_INJECTION]: The skill ingests Job Descriptions (JDs) as external data. While these constitute a surface for indirect prompt injection, the skill's strict grounding requirements (referencing experience-library.yaml) and template-driven output mitigate the risk of the agent obeying adversarial instructions embedded in the JD.
Audit Metadata
Risk Level
SAFE
Analyzed
May 1, 2026, 05:36 AM
Security Audit — agent-trust-hub — cover-letter