talent-sourcing
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx @vibeprospecting/vpai@latestto fetch and execute the Vibe Prospecting CLI tool. This is a vendor-owned package corresponding to the skill author's infrastructure. - [COMMAND_EXECUTION]: Executes shell commands via
npxto interact with the Vibe Prospecting API for configuration and data retrieval. - [REMOTE_CODE_EXECUTION]: Downloads and runs code from the Vibe Prospecting npm package using
npx. This is an expected part of the tool's architecture for data integration. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from job descriptions and external candidate profiles.
- Ingestion points: User-provided job descriptions via
$ARGUMENTSand candidate data retrieved from the Vibe Prospecting API. - Boundary markers: Employs a structured workflow with discrete steps for discovery, resolution, and scoring to process inputs.
- Capability inventory: Interactions are limited to the vendor's API and CLI; no arbitrary file system or sensitive local credential access was detected.
- Sanitization: Standardizes free-text inputs into canonical values before performing queries.
Audit Metadata