job-post-builder
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external web searches and existing local files to inform the content of generated documents, which could lead to instructions being inadvertently followed if present in those sources.
- Ingestion points: Web search results for comparable job postings (Phase 2) and existing JD/template files found in Google Drive or on the Desktop (Phase 2).
- Boundary markers: The skill does not define explicit delimiters or use specific instructions to ignore embedded commands within the ingested data before using it to draft documents.
- Capability inventory: File creation via docx skill, browser automation for DocuSign (Claude in Chrome), and email drafting via Gmail MCP.
- Sanitization: No explicit sanitization or filtering of external search results or local file content is described.
- [DATA_EXFILTRATION]: The skill reads local files from the Desktop and Google Drive to locate templates. It also performs web searches and uploads documents to DocuSign. These actions are primary functions of the skill and target well-known, trusted services, and thus do not represent a security risk.
Audit Metadata