brief-cultural-fit
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill reads from ground-truth.md, which contains sensitive personal information such as location preferences and family constraints. This access is necessary for the cultural fit analysis but involves processing private user data.
- [COMMAND_EXECUTION]: Employs restricted shell commands (mkdir and test) to manage the local research workspace and verify file existence (Procedure Step 1).
- [PROMPT_INJECTION]: Indirect prompt injection surface exists as the skill fetches and processes untrusted data from external websites, such as engineering blogs and Glassdoor (Procedure Step 4), to analyze company culture.
- [SAFE]: The design incorporates explicit guardrails that prioritize user-provided ground-truth data over company marketing materials and requires evidence-based justification for fit assessments.
Audit Metadata