interview-task
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill facilitates a standard administrative workflow for hiring within the polarsource organization. All repository operations are scoped to the vendor's own infrastructure.
- [COMMAND_EXECUTION]: The skill utilizes bash scripts (
fork-repository,setup-remote) and CLI tools (git,gh). Security is maintained through strict regex validation (^[a-zA-Z0-9_-]+$) on candidate names and branch names to prevent command injection. - [INDIRECT_PROMPT_INJECTION]: The skill ingests a user-provided prompt to drive code generation. While it lacks explicit delimiters for this input, it is a low-risk surface as the input is provided by the interviewer (the skill operator) and targeting their own private fork.
- Ingestion points: User input prompt for PR description in
SKILL.md. - Boundary markers: Absent.
- Capability inventory: Shell execution (
gh,git,bash) and file modification. - Sanitization: Metadata inputs are validated via regex in secondary scripts.
Audit Metadata