rocketlist-job-search
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's helper script (scripts/rocketlist.py) downloads job and company datasets in compressed JSONL format from the rocketlist-ai/startup-jobs repository on GitHub. These downloads are performed from a well-known service and are necessary for the skill's primary function.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes third-party data from external job postings, which constitutes an attack surface for indirect prompt injection. To mitigate this risk, the SKILL.md file includes an explicit 'Untrusted-data boundary' instruction, directing the agent to treat all retrieved fields as data rather than instructions and to ignore any embedded commands.
Audit Metadata