cavuno-board-applications
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill defines a standard workflow for job applications and tracking using the
@cavuno/boardSDK. No malicious behaviors such as data exfiltration to unauthorized domains, obfuscation, or unauthorized command execution were detected. - [PROMPT_INJECTION]: The skill processes data from job listings and candidate applications, which constitutes a potential surface for indirect prompt injection.
- Ingestion points: Data enters the context via
board.me.applications.listandboard.me.applications.retrieve(SKILL.md), which may contain untrusted text from external sources. - Boundary markers: Absent; the skill does not specify the use of delimiters or specific instructions to ignore embedded commands within the application data.
- Capability inventory: The skill uses SDK methods for network communication (API requests) and file handling (resume uploads).
- Sanitization: No explicit sanitization or filtering of candidate-provided strings or resume files is documented.
Audit Metadata