nmt-analyze-interviews
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process large volumes of untrusted external data, such as deep-interview transcripts, support logs, and chat records, which could contain malicious instructions intended to manipulate the agent's output or behavior.
- Ingestion points: Processes transcripts, notes, sales-call transcripts, support/chat logs, and survey open-ends from user-provided files (SKILL.md).
- Boundary markers: Absent. There are no explicit instructions for the orchestrator or subagents to isolate or escape potentially malicious text within the ingested data.
- Capability inventory: The agent has the ability to read/write files, execute shell commands (cat, curl), and spawn subagents with general-purpose access (SKILL.md).
- Sanitization: Absent. The skill does not describe any validation or filtering mechanisms for the external text data.
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill includes an automated update check that executes shell commands to make a network request.
- Evidence: The skill instructs the agent to execute
v="$(cat .nmt-version 2>/dev/null)"; curl -fsSL --max-time 2 "https://nextmovetheory.com/version?skill=nmt-analyze-interviews${v:+&v=$v}"at the conclusion of the workflow. - Context: The request targets
nextmovetheory.com, which is the official domain associated with the skill's methodology and author (ztemerbekov). This is a standard vendor-provided telemetry and update mechanism.
Audit Metadata