company-research

Pass

Audited by Gen Agent Trust Hub on Aug 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local Node.js script profile-strength.mjs using the command node "{job_hunt_skills_root}/scripts/profile-strength.mjs" --pulse. This is used to generate search momentum and profile strength updates at the end of the workflow.
  • [EXTERNAL_DOWNLOADS]: The workflow involves fetching data from various external sources using web browsing, including company websites, job boards, and review platforms such as LinkedIn, Glassdoor, and Blind to perform evaluations. It also references the author's official resource at remotivated.com.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external web sources and processes it to generate reports and recommendations.
  • Ingestion points: Web content from job postings, LinkedIn profiles, and company review sites (found in SKILL.md Step 2).
  • Boundary markers: The skill does not define specific delimiters or instructions to the agent to ignore potentially malicious instructions embedded in the researched web content.
  • Capability inventory: The agent has permissions to read and write files in the my-documents/ directory and execute the profile-strength.mjs script (found in SKILL.md Step 6).
  • Sanitization: There is no evidence of sanitization or filtering applied to the data retrieved from external web sources before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 9, 2026, 02:29 PM
Security Audit — agent-trust-hub — company-research