job-application-operator
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed to read highly sensitive personal information, including identity details, citizenship status, and salary expectations, from local configuration files in
~/.config/AgentDesk/private/. It transmits this data to external, non-whitelisted job application websites via browser automation tools. Although this is the intended primary purpose, it represents a significant risk for potential exfiltration of sensitive profile data to untrusted destinations. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external job application forms, creating a vulnerability where a malicious site could attempt to influence agent behavior through crafted form field labels or descriptions.
- Ingestion points: The skill inventories and reads field labels, types, and options from external job application URLs using browser automation (SKILL.md).
- Boundary markers: The skill implements a strict field classification system and 'Hard Stops' for unknown or ambiguous questions, which mitigates the risk of the agent obeying instructions embedded in form fields (SKILL.md).
- Capability inventory: The agent has the capability to read sensitive local PII (personal profiles, documents) and perform network/browser operations (agent-browser CLI, Playwright) (SKILL.md).
- Sanitization: External form content is matched against a pre-validated local policy, and the skill explicitly prohibits the use of automation-evasion techniques like CAPTCHA solving (SKILL.md).
Audit Metadata