dataify-indeed-job-listings

• Outcome: Pass
• Latest audit: Jun 8, 2026 at 2:35 AM UTC
• Version:
  1.1.0

Overview

This skill is a disclosed Dataify helper for collecting Indeed job listings, but users should handle the Dataify token carefully.

Install only if you intend to send Indeed job URLs to Dataify. Prefer setting DATAIFY_API_TOKEN through a secure local secret mechanism or environment variable instead of passing it with --token, and review the confirmation table before approving any API call.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill instructs the agent to access environment variables and make outbound network/API calls, but it does not declare permissions for those capabilities. This creates a trust and enforcement gap: a reviewer or runtime may not realize the skill can read secrets such as DATAIFY_API_TOKEN and send data to an external service, increasing the risk of unintended secret use or data exfiltration.

VirusTotal

65/65 vendors flagged this skill as clean.