research
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process data from external, untrusted sources including job boards, social media, and industry forums, which presents a surface for malicious instruction injection. \n
- Ingestion points:
SKILL.mdandreference/market.mdinstruct the agent to crawl LinkedIn, Glassdoor, Indeed, Reddit, and various industry forums. \n - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the research templates. \n
- Capability inventory: The agent has implicit network access for data retrieval and explicit instructions to write session results to the local filesystem (
SKILL.md). \n - Sanitization: There are no instructions for sanitizing or validation of content retrieved from external sources before processing. \n- [COMMAND_EXECUTION]: The skill involves using external tools and commands to perform scraping and discovery of MCP servers, which could be leveraged to execute arbitrary logic. \n- [DATA_EXFILTRATION]: The skill provides instructions to read sensitive local configuration files such as
claude_desktop_config.jsonfor server discovery and writes execution metrics to the~/.claude/skill-analytics/directory, which involves accessing hidden directories used by the agent host environment.
Audit Metadata