linkedin-job-scraper
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests job titles, descriptions, and company names directly from LinkedIn listings into the agent's context. An attacker could craft a malicious job posting containing instructions that influence the agent's subsequent behavior when it parses and presents these results.
- Ingestion points:
scripts/jobspy_scraper.pyfetches job data and prints a preview table to the agent's console. - Boundary markers: None identified in the prompt interpolation; the agent is simply instructed to interpret and present the findings.
- Capability inventory: The agent has full shell access to run the scraper and manage files in
.tmp/. - Sanitization: No sanitization of the scraped content is performed before presentation to the agent.
- [COMMAND_EXECUTION]: The skill requires the agent to execute local Python scripts and shell commands (
pip install,python tools/jobspy_scraper.py). While these are part of the intended functionality, they represent a privilege surface that could be abused if the agent is manipulated by external data.
Audit Metadata