generate-targets

Pass

Audited by Gen Agent Trust Hub on May 1, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to perform a curl POST request to a local service (http://localhost:8791/api/agent/batch-scan). This command is used to trigger a secondary automated process for scanning job openings at the identified companies and does not interact with external untrusted servers.
  • [PROMPT_INJECTION]: The skill processes untrusted data from the web via the WebFetch tool to generate company scores and summaries.
  • Ingestion points: External career pages and job board data (Greenhouse, Ashby, Lever, etc.) are fetched and parsed.
  • Boundary markers: No specific delimiters or "ignore instructions" markers are defined for handling the content returned from the web.
  • Capability inventory: The agent has the ability to perform file writes (Write, Edit) and execute shell commands (Bash).
  • Sanitization: There are no instructions to sanitize or escape data fetched from the web before it is written to the local target-companies.yaml file, creating a potential surface for indirect prompt injection if malicious content is present on a fetched page.
Audit Metadata
Risk Level
SAFE
Analyzed
May 1, 2026, 05:36 AM
Security Audit — agent-trust-hub — generate-targets