startup-interview-synthesis
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied content like interview notes and outreach replies in SKILL.md. While boundary markers for this data are not explicitly defined in the input request, the skill's workflow and rubric provide a structured framework for analysis. The capability inventory includes file-writing for HTML reports. Sanitization is explicitly addressed by the instruction to HTML-escape all user-provided text and prohibit embedded scripts or external assets.
- [DYNAMIC_EXECUTION]: The skill facilitates the creation of single-file HTML artifacts. It proactively addresses security by requiring all user-supplied data to be HTML-escaped and forbidding the use of external assets, fonts, or scripts, which prevents potential Cross-Site Scripting (XSS) or network-based exfiltration from the generated file.
Audit Metadata