interview-question-generator
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to execute a local Node.js script located atplugins/grc-engineer/scripts/generate-interview-questions.js. This script appears to be a vendor-specific resource intended to provide the core functionality of the skill. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates untrusted user data into shell commands executed via the
Bashtool. - Ingestion points: User-provided technology stack descriptions and compliance framework names are accepted as input and passed as positional arguments to the
nodeCLI command inSKILL.md. - Boundary markers: The skill does not define any boundary markers, delimiters, or explicit instructions for the agent to validate or escape the user-provided strings before command interpolation.
- Capability inventory: The skill is granted access to the
Bashtool, which allows for broad system command execution if the input arguments are manipulated to include shell metacharacters. - Sanitization: There is no evidence of sanitization, filtering, or strict schema validation for the external content processed by the script.
Audit Metadata