interview-master
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell scripts (
analyze-commits.sh,extract-tech-stack.sh) and a Python script (calculate-impact.py) to executegitcommands on local repositories. These tools are intended for generating repository statistics and project impact metrics as part of the skill's primary resume generation workflow.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes git commit messages and file contents which are potentially attacker-controlled.\n - Ingestion points: Git commit logs and repository files are analyzed by scripts in the
scripts/directory.\n - Boundary markers: The skill does not implement specific delimiters or warnings to ignore instructions embedded in commit messages.\n
- Capability inventory: The skill utilizes subprocess execution (git) and file system access across all its analysis scripts.\n
- Sanitization: No sanitization logic was identified for the content extracted from git history before it is passed to the agent for resume generation.
Audit Metadata