rolewire
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the
rolewire-mcppackage from the npm registry usingnpx -y rolewire-mcp@latest. This is a vendor-owned package designed to provide the core functionality of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and displays job descriptions and company data from external sources (company ATS platforms via
rolewire.app). - Ingestion points: Job data fetched via
search_jobs,get_job_detailtools, androlewire.appHTTP endpoints. - Boundary markers: None specified in the instructions.
- Capability inventory: The skill uses network requests (
curl,fetch) and shell command execution for tool installation. - Sanitization: No explicit sanitization or filtering of fetched external content is described.
Audit Metadata