job-posting-comparison
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes job descriptions and web content from external sources, which creates a potential surface where embedded instructions could attempt to influence the agent's behavior.
- Ingestion points: Job posting details and web content retrieved from external sites via
scripts/crawlora.sh. - Capability inventory: Network operations via the Crawlora API helper script.
- Boundary markers: The skill does not define explicit delimiters to isolate untrusted data.
- Sanitization: No explicit sanitization or filtering of external content is defined in the instructions.
- [COMMAND_EXECUTION]: The skill uses a local bash script
scripts/crawlora.shto interface with the vendor's API. - The script contains robust security protections, including validating the API key format to prevent injection, restricting requests to a whitelist of allowed paths and HTTP methods, and preventing local file disclosure by rejecting the
@character in query parameters.
Audit Metadata