indeed-jobs-api
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill interacts exclusively with the scavio-ai vendor infrastructure. Network requests are directed to api.scavio.dev, and the required software libraries (scavio) are vendor-official packages. No unauthorized data exfiltration or suspicious network patterns were detected.
- [CREDENTIALS_UNSAFE]: The skill requires a Scavio API key. The documentation follows security best practices by explicitly instructing users to store the key in environment variables (SCAVIO_API_KEY) and avoid hardcoding it in source control. The code examples provided use non-functional placeholders.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests job descriptions and employee reviews from Indeed. Ingestion points: External data enters through the search and job detail endpoints. Boundary markers: None are explicitly used in the prompt template. Capability inventory: The skill is limited to data retrieval and display. Sanitization: The skill includes 'Guardrails' that instruct the agent to attribute reviews to their sources and avoid fabricating information, which serves as a behavioral mitigation for processing untrusted external content.
Audit Metadata