job-market-research
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill interacts with the Crawlora API at api.crawlora.net, which is the vendor's official endpoint for the service.
- [SAFE]: The helper script scripts/crawlora.sh demonstrates robust security by handling the CRAWLORA_API_KEY through temporary restricted configuration files, preventing exposure in process lists or logs.
- [SAFE]: Strong input validation is implemented for both the API key and requested paths, utilizing a strict allowlist of supported routes and preventing injection attacks.
- [INDIRECT_PROMPT_INJECTION]: The skill fetches data from public job boards via the Crawlora API, which constitutes a potential surface for indirect prompt injection. Evidence: 1. Ingestion points: API responses processed in scripts/crawlora.sh. 2. Boundary markers: Absent. 3. Capability inventory: Network operations via curl in scripts/crawlora.sh. 4. Sanitization: Fetched data is returned as raw JSON without further processing.
Audit Metadata