Ashby

• Outcome: Review
• Latest audit: May 29, 2026 at 9:36 PM UTC
• Version:
  1.0.2

Overview

This Ashby skill is a real recruiting-data integration, but it needs Review because it can broadly read and change live HR records, including through a raw authenticated API proxy, without clear confirmation or scope limits.

Install only if you intend to let an agent work with Ashby through Membrane. Use a least-privileged Ashby/Membrane connection, verify the connection ID, and require explicit approval before creating or updating candidates, applications, jobs, notes, offers, stages, or using the raw proxy request command.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The manifest description narrows the skill to Persons, Users, and Roles, but the body documents significantly broader capabilities including applications, candidates, jobs, offers, notes, and stage changes. This mismatch can mislead routing, review, and user expectations, increasing the chance the skill is invoked for higher-impact operations than its summary suggests.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documented proxy feature enables arbitrary authenticated API requests beyond the listed curated actions, materially expanding the skill's effective capability. If consumers rely on the manifest and action list alone, they may underestimate that the skill can reach unreviewed endpoints and perform unexpected operations against Ashby.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The invocation description is broad enough to match many generic Ashby-related requests without clearly limiting what tasks should trigger the skill. In an agentic environment, over-broad triggering can cause this skill to be selected when a narrower or safer tool would be more appropriate, increasing the chance of unnecessary access to sensitive recruiting data or unintended writes.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill advertises creation and update actions on live recruiting objects without warning about the consequences of modifying production ATS data. Because Ashby contains sensitive HR and candidate information, accidental writes can alter hiring workflows, candidate records, or offers in ways that are operationally and legally significant.

VirusTotal

63/63 vendors flagged this skill as clean.