proof-asset-creator

Pass

Audited by Gen Agent Trust Hub on Aug 9, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local Node.js script located at {job_hunt_skills_root}/scripts/profile-strength.mjs to calculate and display the user's profile strength upon completion of the ideation workflow.
  • [DATA_EXPOSURE]: To function as intended, the skill reads sensitive personal documents from the my-documents/ directory, specifically resume.md, cv.md, story-bank.md, and applications.md. This data is processed locally to generate project ideas.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from the user's local documents which could theoretically contain malicious instructions.
  • Ingestion points: my-documents/resume.md, my-documents/cv.md, my-documents/story-bank.md, my-documents/proof-assets/, and my-documents/applications.md.
  • Boundary markers: None identified; the skill directly synthesizes information from these files.
  • Capability inventory: Execution of a local Node.js script via node command and file writing to the my-documents/proof-assets/ directory.
  • Sanitization: No specific sanitization or filtering of the document contents is mentioned before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 9, 2026, 02:29 PM
Security Audit — agent-trust-hub — proof-asset-creator