saramin-talent-search
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch updated instructions and legal documentation from the vendor's package (@nomadamas/k-skill) on the NPM registry. - [REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute the
@nomadamas/k-skillCLI tool to retrieve its primary instructions and perform maintenance updates on skill files. - [COMMAND_EXECUTION]: Shell commands are used to display legal disclaimers and instruction sets stored in the vendor's package.
- [INDIRECT_PROMPT_INJECTION]: The skill reads and processes external candidate resumes and career history, which are sources of untrusted data.
- Ingestion points: Candidate data fields and achievement descriptions on
saramin.co.kr. - Boundary markers: Absent; no specific delimiters are defined to isolate resume content from the agent's instructions.
- Capability inventory: Navigating the browser, reading web content, scoring candidates, and returning a text-based shortlist to the user.
- Sanitization: Absent; the skill does not explicitly filter or escape content retrieved from candidate profiles.
Audit Metadata