meta-jobs-research
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with the Crawlora API at api.crawlora.net to retrieve job postings and catalog information. This is expected behavior for a research tool provided by the vendor.
- [COMMAND_EXECUTION]: The skill includes a bash helper script scripts/crawlora.sh that wraps curl commands. The script correctly handles query parameters using --data-urlencode to prevent basic command injection.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes external content from job postings that could contain malicious instructions.
- Ingestion points: The agent reads job details from Meta Careers via the Crawlora API using endpoints like /meta-jobs/job.
- Boundary markers: There are no explicit instructions for the agent to use delimiters or ignore embedded instructions when reading job data.
- Capability inventory: The skill allows execution of a shell script to interact with the external API.
- Sanitization: No sanitization is performed on the job description text retrieved from the API.
Audit Metadata