gtm-scorecard
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches content from external sources to perform company research. Specifically, it accesses well-known job board APIs such as Ashby (api.ashbyhq.com), Greenhouse (boards-api.greenhouse.io), and Lever (api.lever.co), as well as Exa AI (api.exa.ai) for content retrieval and profile discovery.
- [COMMAND_EXECUTION]: Instructs the agent to use shell commands to interact with web services. It employs curl to fetch JSON data from Applicant Tracking System (ATS) providers and search APIs to extract job description text.
- [PROMPT_INJECTION]: Ingests untrusted external data which presents a surface for indirect prompt injection.
- Ingestion points: Processes raw job description text and web search snippets during the research phase (Step 2, Search 4, and Search 5b).
- Boundary markers: Includes a strict "Evidence Firewall" and "Tool & Tech-Stack Citation Rule" that requires verbatim quotes and source verification to prevent the agent from being misled by untrusted data.
- Capability inventory: Utilizes web search tools and shell-based network requests (curl).
- Sanitization: Implements a live-link verification requirement to ensure referenced job data is current and authentic.
Audit Metadata