job-apply
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it fetches and processes job postings from external URLs using web search and fetch tools. Maliciously crafted job descriptions could attempt to influence the agent's behavior during the drafting phase.
- Ingestion points: Job posting content fetched via WebFetch and WebSearch tools.
- Boundary markers: No explicit delimiters or instructions are provided to the model to ignore embedded commands within the fetched job posting text.
- Capability inventory: The agent has access to
draft_email(Gmail) and various file reading capabilities. - Sanitization: There is no evidence of sanitization or filtering of the external content before it is processed.
- [DATA_EXFILTRATION]: The skill accesses sensitive local files to manage the user's career search workflow. While this is the intended functionality, it constitutes a data exposure surface.
- Evidence: The skill references local paths such as
/Users/forni/Craft/vocation/network/contacts.mdand/Users/forni/Craft/vocation/companies/. These files contain personal network information and company research which are processed by the agent to generate drafts.
Audit Metadata