Security audit
Security checks for vulnerabilities and agentic risk
This skill fetches public job listings from disclosed careers endpoints, with network access and optional output writing that are limited and explained.
Install only if you want a Node-based helper that fetches public job-board data from the listed Acxiom and LiveRamp endpoints. Use the documented scripts/cli.mjs entrypoint, review any --out path before running, and ignore the bundled recipe's standalone evidence CLI unless you intentionally want its broader behavior.
Referenced artifact was not completely inspected
reers board and needs the source and coverage stated. The installed command is `scripts/cli.mjs`. A description match does not select this skill, does not run t
Referenced artifact was not completely inspected
reers board and needs the source and coverage stated. The installed command is `scripts/cli.mjs`. A description match does not select this skill, does not run t
Referenced artifact was not completely inspected
reers board and needs the source and coverage stated. The installed command is `scripts/cli.mjs`. A description match does not select this skill, does not run t
Referenced artifact was not completely inspected
`recipe/boards.mjs` is the upstream file. Do not run it as the installed command. Its own CLI writes an evidence file and reads every board. This command reads
Referenced artifact was not completely inspected
`recipe/boards.mjs` is the upstream file. Do not run it as the installed command. Its own CLI writes an evidence file and reads every board. This command reads
The skill explicitly performs network access and invokes a Node.js CLI, but the manifest does not declare any tool scope such as allowed tools or permissions. That creates a trust gap for agents and policy engines, which may run the skill without clear enforcement boundaries on shell and network behavior.
Importing file-write capability enables persistence of fetched data to local storage, and this capability is in fact used later to save board contents to an evidence JSON file. For a skill whose stated purpose is to return rows and coverage, unexpected local persistence creates unnecessary data retention and side effects that can leak information into the host filesystem or violate least-privilege expectations.
The module contains a standalone CLI that fetches all configured job boards and writes a local evidence artifact, which exceeds the stated skill behavior of fetching one supported board for return to the caller. Hidden or undocumented capability expansion is dangerous because it broadens data collection and side effects, making the component behave differently than integrators and policy reviewers would expect.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
};
const ashbyCtx = {
boardUrl: "https://jobs.ashbyhq.com/liveramp-inc",
source: "https://api.ashbyhq.com/posting-api/job-board/liveramp-inc",
fetchedAt: ctx.fetchedAt,
};
const good = { title: "One", externalPath: "/job/A/One_1", locationsText: "Remote" };
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
};
const ashbyCtx = {
boardUrl: "https://jobs.ashbyhq.com/liveramp-inc",
source: "https://api.ashbyhq.com/posting-api/job-board/liveramp-inc",
fetchedAt: ctx.fetchedAt,
};
const good = { title: "One", externalPath: "/job/A/One_1", locationsText: "Remote" };
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
test("request gate rejects insecure protocols and embedded credentials", () => {
for (const url of [
"http://api.ashbyhq.com/posting-api/job-board/liveramp-inc",
"https://user:secret@api.ashbyhq.com/posting-api/job-board/liveramp-inc",
"https://api.ashbyhq.com.evil.example/posting-api/job-board/liveramp-inc",
]) assert.equal(gateRequest(url).ok, false);
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
for (const url of [
"http://api.ashbyhq.com/posting-api/job-board/liveramp-inc",
"https://user:secret@api.ashbyhq.com/posting-api/job-board/liveramp-inc",
"https://api.ashbyhq.com.evil.example/posting-api/job-board/liveramp-inc",
]) assert.equal(gateRequest(url).ok, false);
assert.equal(gateRequest(ashbyCtx.source).ok, true);
});
The recipe documentation advertises an unrelated external task-help/contact service that is outside the stated purpose of fetching public careers-board data. In a security-sensitive agent ecosystem, this can steer users or downstream agents toward an unnecessary third-party endpoint, creating a social-engineering and trust-boundary risk even though it does not itself execute code.
No suspicious patterns detected.