application-tracker
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python's
subprocessmodule in its test suite (tests/test_draft_followup.pyandtests/test_generate_tracker_html.py) to verify the CLI functionality of its internal scripts. This is standard development practice and the execution is restricted to the skill's own verified scripts. - [DATA_EXFILTRATION]: The skill reads from local JSON files (
postings.json,tracker.json) to manage job application data. Analysis confirms there are no network operations or external data transmissions. The skill includes a 'load-bearing safety test' (test_no_smtp_or_send_imports_in_script) to ensure that no email-sending libraries are ever imported, maintaining a strict local-only execution model for sensitive job search data. - [PROMPT_INJECTION]: The skill instructions provide clear boundaries for the AI agent, specifically directing it not to use this skill for resume tailoring or job searching, which are handled by sister skills. It includes specific warnings against 'auto-sending' and requires human-in-the-loop personalization for all drafts, preventing the agent from autonomously sending generated content.
- [EXTERNAL_DOWNLOADS]: The skill is self-contained. It generates an
ApplicationTracker.htmlfile using a local CSS asset (assets/templates/tracker.css). It does not fetch external resources, scripts, or stylesheets at runtime.
Audit Metadata