interview-system-designer
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were detected. The skill consists of documentation and Python scripts that utilize only the standard library.
- [REMOTE_CODE_EXECUTION]: No remote code execution patterns or external script downloads were found. The tool is designed to run locally and explicitly states that no external dependencies are required.
- [DATA_EXFILTRATION]: The scripts do not perform network operations (such as curl, wget, or fetch) or attempt to access sensitive system directories like .ssh or .aws credentials.
- [PROMPT_INJECTION]: No evidence of prompt injection, role-play jailbreaks, or instructions to bypass safety guardrails was identified in the documentation or code.
- [OBFUSCATION]: No obfuscated code, encoded strings, or hidden content patterns (like zero-width characters) were found during the analysis.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied JSON data through its analysis scripts. 1. Ingestion points: JSON input files provided via the --input argument in hiring_calibrator.py, loop_designer.py, and question_bank_generator.py. 2. Boundary markers: No specific delimiters are used as the data is processed by Python scripts for analytical reporting rather than being interpolated into LLM prompts. 3. Capability inventory: The scripts have file-write capabilities for report generation but no network, subprocess, or execution capabilities. 4. Sanitization: hiring_calibrator.py includes a _validate_interview_record method that performs basic type checking and score range validation.
Audit Metadata