Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Jobber integration that can access and modify business data through Maton, with high-impact automation features documented but gated by explicit user approval.
Install only if you intend to use Maton to access a Jobber account and possibly create user-approved automations. Review every write, function deploy, trigger, or destination carefully, especially anything involving invoices, customer data, persistent forwarding, or API keys.
Early in the file, the skill explicitly says 'Jobber is not an event source' and that triggers cannot read Jobber data. Later, the Webhooks section asserts that Jobber supports webhook event types such as CLIENT_CREATE and JOB_COMPLETE, which directly contradicts the earlier intent-setting guidance about event capabilities.
The Jobber manifest says the skill is for Jobber API operations and explicitly states that Jobber is not an event source; this file instead documents Linear webhook events and how to use them. Even though the file notes it is shared platform reference text, it still exposes an unrelated capability that is not justified by the Jobber skill's stated purpose.
The manifest frames the skill as a Jobber integration whose used endpoints are specifically documented, with additional platform reference text supposedly adding no Jobber capability. However, the file also documents and enables broad Maton function and trigger management, including creating, deploying, invoking, and wiring hosted code and destinations, which are capabilities beyond directly managing Jobber records/endpoints.
No suspicious patterns detected.
