job-application-kit
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool and Python'ssubprocessmodule to execute document processing utilities includingpdfinfo,pdftotext, and LaTeX compilers (lualatex,xelatex). These operations are confined to the necessary task of generating and validating the text layer of resume and cover letter PDFs. - [INDIRECT_PROMPT_INJECTION]: The skill implements a strong security boundary for processing untrusted Job Descriptions (JDs). It includes instructions to treat JD content strictly as data, explicitly ignore embedded commands or 'ignore previous instructions' overrides, and prohibits fetching arbitrary URLs found within the JD body to mitigate data exfiltration risks.
Audit Metadata