flow-phd-application
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill acts as an orchestrator that ingests potentially untrusted user data (transcripts, CVs, GitHub profiles) via the
apply-profile-readerstage. This data is then used to influence downstream tasks like drafting Statements of Purpose and cold emails, creating a surface for indirect prompt injection. - Ingestion points: Stage 1 (
apply-profile-reader) ingests "CV, transcripts, research statements, project writeups, publication list, GitHub, target-school materials." - Boundary markers: No explicit delimiters or warnings are mentioned in the orchestration logic to handle embedded instructions within the user-provided materials.
- Capability inventory: The ingested data is passed to tools that perform web searches (
apply-program-fit-mapper), draft content (apply-sop-writer,apply-cold-email-drafter), and strategy planning. - Sanitization: The instructions do not define any sanitization, validation, or filtering of the content extracted from external materials before it is interpolated into prompts for other tools.
Audit Metadata