otameshi-candidate
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bundled Python script (
scripts/check_trial_terms.py) to calculate trial work durations, weekly hours, and compensation rates based on user-provided JSON input. - [EXTERNAL_DOWNLOADS]: References informational and regulatory URLs including the Japanese Ministry of Health, Labour and Welfare (mhlw.go.jp) and the Otameshi Tenshoku service website (otame4.work) for verifying labor laws and service terms.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data including candidate resumes, job descriptions, and chat transcripts.
- Ingestion points: Trial notes, candidate experience descriptions, and employer job listings (SKILL.md).
- Boundary markers: The instructions mandate a clear distinction between private reasoning/analysis and the draft content intended for the employer (SKILL.md).
- Capability inventory: Limited to local Python script execution for arithmetic and validation; no network exfiltration or persistent file system operations are present.
- Sanitization: External input is processed through a common validation utility (
scripts/_common.py) that enforces data types and utilizes regular expressions to identify and potentially protect sensitive personal information patterns.
Audit Metadata