meta-jobs-research
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No prompt injection or behavior override patterns detected.
- [DATA_EXPOSURE_AND_EXFILTRATION]: API keys are handled securely using environment variables. The script uses a temporary curl configuration file to pass the key in a header, which prevents the secret from appearing in system process lists (e.g., via
ps). - [COMMAND_EXECUTION]: The helper script
scripts/crawlora.shimplements strict input validation. It enforces an alphanumeric format for the API key and restricts API calls to a hardcoded whitelist of approved paths (/meta-jobs/job,/meta-jobs/list,/meta-jobs/search). - [EXTERNAL_DOWNLOADS]: Network operations are directed exclusively to the vendor's official API domain (
api.crawlora.net). Parameters are safely URL-encoded, and the script explicitly rejects dangerous characters like@to prevent unauthorized file access via curl. - [INDIRECT_PROMPT_INJECTION]: While the skill ingests external data (job postings), the implementation is secure. 1. Ingestion Point: Data from
api.crawlora.net. 2. Boundary Markers: Absent (returns raw JSON). 3. Capability Inventory: Vendor-restricted network requests viacurl. 4. Sanitization: Strict path whitelisting and parameter encoding.
Audit Metadata