skills/hirifyme/hirify-cli/hirify/Gen Agent Trust Hub

hirify

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to use hirify-cli, which is downloaded and executed from the npm registry via npx or global installation.\n- [REMOTE_CODE_EXECUTION]: The skill utilizes npx -y hirify-cli, which involves fetching and executing code from the remote npm registry at runtime.\n- [COMMAND_EXECUTION]: The skill's core functionality relies on executing the hirify CLI tool via shell commands to interact with the Hirify platform services.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources (job vacancy descriptions and filter guides) via hirify vacancy read and hirify filter guide. This content is processed by the agent and could potentially contain malicious instructions.\n
  • Ingestion points: Data is fetched from the Hirify API through the hirify CLI (specifically vacancy descriptions, feed content, and filter guides).\n
  • Boundary markers: No specific delimiters or instructions are provided to treat this data as untrusted or to ignore instructions within the ingested text.\n
  • Capability inventory: The agent can perform significant mutations such as applying for jobs (hirify vacancy apply), creating notification feeds, and making generic API calls.\n
  • Sanitization: No sanitization or validation of the fetched vacancy text or filter guide is mentioned before it is processed by the model.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 07:01 PM