cover-letter
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection vulnerability surface. The skill is designed to ingest and process untrusted external data in the form of Job Descriptions (JD) and Resumes to generate cover letters.
- Ingestion points: External data enters the agent context through the '目标岗位 JD' (Target JD) and '简历' (Resume) inputs.
- Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the ingested data.
- Capability inventory: Analysis of the skill reveals it is limited to text generation; it does not utilize subprocess calls, file system writes, or network operations.
- Sanitization: There are no explicit instructions for sanitizing or escaping the content of the JD or Resume before processing.
Audit Metadata