hunter-cover

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes a local Python script (cover.py) to perform automated quality checks on the generated cover letters. The script uses only the Python standard library to perform text processing and regex-based validation (e.g., checking word counts, banned cliches, and number consistency).
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external sources, specifically user resumes and company research briefs, to tailor its output. This represents an inherent indirect prompt injection surface.
  • Ingestion points: Resume files (hunter/resumes/) and company research briefs (hunter/companies/).
  • Boundary markers: The skill does not explicitly use delimiters or guardrail instructions when interpolating this external data into the LLM's context.
  • Capability inventory: The skill has the capability to execute shell commands (running the cover.py script) and write files to the local hunter/covers/ directory.
  • Sanitization: No explicit sanitization or filtering of the input text from resumes or research briefs is documented before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 08:22 PM