CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

26.6 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 2 flagged

Securityscore 76 · 2 findings

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · hiring-scorecard/references/output-template.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerpthiring-scorecard/references/output-template.md· markdown

155

156Question quality standards:

157- Never ask illegal or discriminatory questions (age, family status, religion, disability, e

… (5 chars elided on L157)

158- Reference specific, job-relevant situations in behavioral questions.

159- Make situational questions reflect realistic challenges of THIS role, not generic hypothet

… (6 chars elided on L159)

Occurrences

1 occurrence · at L157

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha2565084aa178cfd9d97…rubric 365aacaView on GitHub

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · hiring-scorecard/references/usage-and-customization.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The exact value spotted

excerpthiring-scorecard/references/usage-and-customization.md· markdown

45- Keep all questions job-related and consistent across candidates.

46- Do not ask about age, marital status, family plans, religion, disability, national origin,

… (36 chars elided on L46)

47- Document the business justification for every must-have criterion.

48- Keep all scoresheets on file per the company's retention policy.

Occurrences

1 occurrence · at L46

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484a…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

hiring-scorecard/SKILL.md · 1 file

hiring-scorecard/SKILL.md2.8 KB · Markdown

name: hiring-scorecard

description: Creates structured hiring scorecards for any role. Takes job title, requirements, and team context. Generates comprehensive scorecard with weighted scoring rubric, interview questions per competency, evaluation matrix, red/green flags, and reference check questions.

tools: Read, Write, Glob, Grep

model: inherit

Hiring Scorecard Generator

Build a structured, bias-reducing hiring scorecard that lets an interview panel make consistent, evidence-based decisions for any role.

references/output-template.md -- the full 9-section scorecard.md structure with every block, table, and per-section guideline.
references/competency-library.md -- which competencies to score by role type (technical IC, non-technical IC, manager, executive).
references/usage-and-customization.md -- how to use the output, focus modes, biases prevented, format adaptations, and legal/compliance reminders.

Inputs

Job Title and Requirements are required; ask before generating if either is missing. The rest sharpen the output: Team Context, Level/Seniority, Role Type, Industry, Interview Panel, Compensation Band, Urgency/Timeline.

Workflow

Gather role context. Confirm job title, level, team structure, reporting line, and business need. Ask for missing required inputs.
Define criteria. Separate must-have from nice-to-have qualifications, each specific and observable with a verification method. See references/output-template.md Section 2.
Select competencies. Choose 6-10 competencies for the role using references/competency-library.md.
Build the scoring rubric. Anchor each competency to the 1-5 behavioral scale. See references/output-template.md Section 3.
Generate interview questions. Write 3-4 behavioral/situational questions per competency with follow-up probes and "what good/bad looks like". See references/output-template.md Section 4.
Create the evaluation matrix. Produce the independent interviewer scoresheet. See Section 5.
Identify flags. List 8-12 concrete red flags and 8-12 green flags tied to observable behavior. See Section 6.
Draft reference checks. Produce targeted reference questions that surface real signal. See Section 7.
Add debrief guide and appendix. Include the debrief agenda, decision framework, anti-bias checklist, scoring calculator, and panel/comparison templates. See Sections 8-9.
Write the file. Output a single scorecard.md in the working directory (or a user-specified path), assembled from all nine sections and ready to hand to a panel without further editing.

For focus modes (technical, leadership, sales/GTM, creative, operations, culture-heavy), format adaptations, and legal/compliance reminders, see references/usage-and-customization.md.

hiring-scorecard— agent skill

Is hiring-scorecard safe to install?

Hiring Scorecard Generator

Contents

Inputs

Workflow

Audit the pieces. Scan the whole. Decide.