otameshi-candidate

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a bundled Python script (scripts/check_trial_terms.py) to calculate trial work durations, weekly hours, and compensation rates based on user-provided JSON input.
  • [EXTERNAL_DOWNLOADS]: References informational and regulatory URLs including the Japanese Ministry of Health, Labour and Welfare (mhlw.go.jp) and the Otameshi Tenshoku service website (otame4.work) for verifying labor laws and service terms.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data including candidate resumes, job descriptions, and chat transcripts.
  • Ingestion points: Trial notes, candidate experience descriptions, and employer job listings (SKILL.md).
  • Boundary markers: The instructions mandate a clear distinction between private reasoning/analysis and the draft content intended for the employer (SKILL.md).
  • Capability inventory: Limited to local Python script execution for arithmetic and validation; no network exfiltration or persistent file system operations are present.
  • Sanitization: External input is processed through a common validation utility (scripts/_common.py) that enforces data types and utilizes regular expressions to identify and potentially protect sensitive personal information patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 05:38 AM