job-posting-match
Fail
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The SKILL.md instructions direct the agent to fetch its primary instructions and execute tools at runtime using 'npx -y @nomadamas/k-skill@0'. This pattern downloads and executes code from an external, non-trusted package, allowing the remote source to change the skill's behavior dynamically.
- [EXTERNAL_DOWNLOADS]: The skill performs automated network requests to fetch data from 'www.jobkorea.co.kr' and 'www.saramin.co.kr' via the scripts/job_posting_match.py script.
- [COMMAND_EXECUTION]: The workflow relies on executing shell commands, including 'npx' for remote tooling and 'python3' for local matching logic.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user resumes and external job postings which could contain malicious instructions designed to influence agent behavior during the matching and strategy generation phase.
- Ingestion points: resume_text input and job portal HTML content fetched by scripts/job_posting_match.py.
- Boundary markers: The prompt interpolation logic in instruction.md lacks explicit delimiters or instructions to ignore embedded commands within the resume or job data.
- Capability inventory: The skill possesses network access (urllib.request) and the ability to execute shell commands via npx.
- Sanitization: The clean_text function in the Python script removes script/style tags and unescapes HTML, but does not provide robust protection against NL-based prompt injection.
Recommendations
- AI detected serious security threats
Audit Metadata