proof-asset-creator
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Node.js script located at
{job_hunt_skills_root}/scripts/profile-strength.mjsto calculate and display the user's profile strength upon completion of the ideation workflow. - [DATA_EXPOSURE]: To function as intended, the skill reads sensitive personal documents from the
my-documents/directory, specificallyresume.md,cv.md,story-bank.md, andapplications.md. This data is processed locally to generate project ideas. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from the user's local documents which could theoretically contain malicious instructions.
- Ingestion points:
my-documents/resume.md,my-documents/cv.md,my-documents/story-bank.md,my-documents/proof-assets/, andmy-documents/applications.md. - Boundary markers: None identified; the skill directly synthesizes information from these files.
- Capability inventory: Execution of a local Node.js script via
nodecommand and file writing to themy-documents/proof-assets/directory. - Sanitization: No specific sanitization or filtering of the document contents is mentioned before processing.
Audit Metadata