hr-network-analyst
Pass
Audited by Gen Agent Trust Hub on Mar 5, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill demonstrates a professional design with detailed documentation on network theory and graph analysis. It includes a dedicated section on ethical guidelines and explicit prohibitions against surveillance or privacy violations.
- [EXTERNAL_DOWNLOADS]: Fetches academic and professional collaboration data from well-known sources such as GitHub, Semantic Scholar, and arXiv, as well as specialized data providers like Apollo and Proxycurl. These downloads are essential for the skill's stated purpose of professional networking research.
- [PROMPT_INJECTION]: The skill ingests untrusted content from the public web and external APIs, creating a surface for potential indirect prompt injection. * Ingestion points: Data enters the agent's context through mcp__firecrawl, WebFetch, and Python-based API requests to sources like GitHub and Semantic Scholar (e.g., in references/data-sources.md). * Boundary markers: There are no explicit markers or instructions provided to the agent to treat external data as untrusted or to ignore embedded instructions within processed profiles or papers. * Capability inventory: The skill possesses the ability to perform network searches, fetch remote web content, and generate local HTML visualization files. * Sanitization: The provided Python reference code parses external JSON and HTML data but lacks specific logic to sanitize strings for potential prompt injection payloads.
Audit Metadata