jobs-create-profile
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides installation instructions for the
sjctlCLI tool by downloading and executing shell scripts directly from the vendor's GitHub repository. - Evidence:
- macOS/Linux:
curl -fsSL https://raw.githubusercontent.com/solid-company/solid-jobs-skills/v0.5.0/scripts/install-sjctl.sh | bash - Windows:
irm https://raw.githubusercontent.com/solid-company/solid-jobs-skills/v0.5.0/scripts/install-sjctl.ps1 | iex - [COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands using the
sjctlbinary to perform database operations (add, import, list, show, set-default). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of natural language self-descriptions or pasted CV text provided by the user.
- Ingestion points: natural language input and CV text in SKILL.md.
- Boundary markers: None specified for the interpolation of user data into the processing logic.
- Capability inventory: The skill uses
sjctlfor database writes and reads, and writes temporary files to the filesystem. - Sanitization: No explicit sanitization or validation of the input text is mentioned before it is processed by the agent to fill markdown templates.
Audit Metadata