Skills
Navigate
skills/ai-job-search-dev/ai-job-search/freehire-search/Gen Agent Trust Hub

freehire-search

Fail

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: CRITICALINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes job descriptions from an external API (freehire.me), which represents an attack surface for indirect prompt injection if job postings contain malicious instructions designed to influence the agent's behavior.
  • Ingestion points: API response data processed in cli/src/commands/search.ts and cli/src/commands/detail.ts.
  • Boundary markers: Absent. The skill does not wrap external content in delimiters or provide specific instructions to the agent to ignore embedded commands.
  • Capability inventory: The skill performs network requests to freehire.me using fetch and produces structured output for the agent.
  • Sanitization: The cleanHtml function in cli/src/helpers.ts removes HTML tags and decodes entities, but it does not filter or sanitize natural language instructions within the text body.
Recommendations
  • CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
  • Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Oct 28, 2026, 03:32 AM