curviate-jobs

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow reads job applicant details and résumés via the Curviate CLI, exposing the agent to untrusted applicant-authored content.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill documents direct financial operations through curviate job publish, which explicitly states that PROMOTED and PROMOTED_PLUS spend real money (lines 50, 124). Authentication and access are enforced by the CLI service via API keys/login (curviate login --api-key or CURVIATE_API_KEY, lines 23-28), providing independent service-layer authentication for the actions.