job-board-scout
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches job postings from public APIs and Applicant Tracking Systems (ATS) including Greenhouse, Lever, Ashby, Arbeitnow, Himalayas, Jobicy, and Remotive. These downloads are performed via HTTP GET requests for the skill's primary purpose of job discovery.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external job postings, which presents an attack surface where malicious instructions could be embedded in job titles or descriptions to influence an agent reviewing the generated queue.
- Ingestion points: Data enters the skill via JSON responses from external job board APIs in
scripts/job_board_scout.py. - Boundary markers: The script does not utilize explicit boundary markers or instructions to the agent to ignore embedded commands in the processed text.
- Capability inventory: The skill's capabilities are limited to network GET requests and local file writing (Markdown and JSON); it does not have shell execution or sensitive file access capabilities.
- Sanitization: The script sanitizes input by stripping HTML tags and removing null bytes from titles, descriptions, and metadata before outputting to the markdown queue.
Audit Metadata