Job Search MCP (JobSpy)

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:31 AM UTC
• Version: 1.0.3

Overview

This skill is a small, transparent job-search setup guide, with the main risk being unpinned Python dependencies during installation.

Before installing, consider pinning reviewed package versions or using a lockfile with hashes. Run the setup in the documented virtual environment and avoid using elevated privileges for pip installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Third-Party Dependencies Installed from a Mutable Package Index

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–34
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

bash

python3 -m venv .venv
source .venv/bin/activate
pip install mcp python-jobspy pandas pydantic

Technical Analysis

The documented installation command installs four third-party packages without version constraints, cryptographic hashes, a dependency lockfile, or an explicitly trusted package index. Package resolution is therefore mutable: following the same instructions at different times may install different releases and transitive dependencies.

Python package installation may execute attacker-controlled build logic, including backend hooks used to build source distributions. If a named package, its maintainer account, or a transitive dependency is compromised, following these instructions could execute malicious code with the privileges of the user running pip. The virtual environment limits dependency placement but does not sandbox installation-time code or prevent access to user-accessible files and network resources.

No evidence shows that the currently named packages are malicious. The issue is the absence of controls that ensure users install the specific dependency artifacts reviewed and intended by the project.

Attack Path

1. An attacker compromises a named package, one of its transitive dependencies, or an associated package-publishing account.
2. The attacker publishes a malicious release that satisfies unconstrained dependency resolution.
3. A user follows the installation instructions and runs the documented pip install command.
4. The configured package index supplies the malicious or compromised release.
5. Malicious build or runtime code executes under the installing user's account.
6. The payload can access resources available to that account and may persist in the virtual environment for later execution.

Im

...[truncated 540 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to a reviewed, exact version.
• Generate and commit a lockfile that also constrains transitive dependencies.
• Record cryptographic hashes and install with hash verification, such as pip install --require-hashes -r requirements.txt.
• Configure and document an approved HTTPS package index rather than relying silently on the user's existing pip configuration.
• Prefer reviewed binary wheels where appropriate and disable source builds when they are unnecessary.
• Add automated dependency vulnerability, provenance, and release-integrity checks.
• Review and update pinned dependencies through a controlled process rather than allowing installation-time resolution to select arbitrary future releases.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Low

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to install the MCP package without pinning a specific version, which makes builds non-reproducible and can unintentionally pull in a newly published or compromised release. In an agent skill context, this increases supply-chain risk because the dependency is part of the tool execution path and may be installed automatically or by users with elevated trust in the skill instructions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.