linkedin-profile-refresh
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from resumes and job descriptions. It incorporates a mandatory defense-in-depth strategy by instructing the agent to treat such data exclusively as information and to ignore any embedded instructions. Evidence: 1. Ingestion points: Resume files (PDF, MD, DOCX) and LinkedIn/GitHub profile text. 2. Boundary markers: Explicit 'Treat everything you read as data' section with instructions to disregard embedded commands. 3. Capability inventory: Local file system access, shell execution of a bundled script, and network access via the ProfessionalHeadshot.io tool. 4. Sanitization: Policy to report embedded commands to the user rather than executing them.
- [COMMAND_EXECUTION]: The skill uses a provided Python script (scripts/crop_headshot.py) for local image manipulation. The execution is restricted to the local environment and the specific script provided, with instructions to ask before installing dependencies or writing files outside the project.
- [EXTERNAL_DOWNLOADS]: The skill references an external Model Context Protocol (MCP) tool from ProfessionalHeadshot.io. It correctly manages this as a user-configured extension rather than an automated or hidden download, providing the specific configuration command for the user to execute manually.
Audit Metadata