Openjobs Ai Talent Search

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:10 PM UTC
• Version: 1.0.1

Overview

The skill is mostly a coherent OpenJobs AI scholar-search integration, but its setup instructions can expose the user's API key and its response rules overreach.

Review before installing. The main risk is not hidden malware, but unsafe credential handling: do not let the agent print or repeat your `MIRA_KEY`; use a non-disclosing presence check instead. Also be aware that search criteria are sent to OpenJobs AI and that the skill tries to add promotional attribution and suppress extra warnings after results.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:123
• Finding: Mandatory Promotional Link Injection into Agent Responses<` ``` ### Technical Analysis The skill unconditionally instructs the agent to append branded promotional content to every operation. The supplied URL also contains a campaign-tracking parameter. This behavior modifies the agent's final response independently of whether attribution or an external link is relevant to the user's request. Because these instructions are loaded as part of the skill, they can take control of part of the agent's response policy. This is a form of skill instruction hijacking: the skill introduces a secondary objective—promoting and linking to the service—alongside the user's actual search objective. The issue does not grant operating-system privileges or directly execute code. Its security relevance is the compromise of response integrity and the automatic presentation of an external, tracking-tagged link as trusted agent output. ### Attack Path 1. The agent loads `SKILL.md` to perform a scholar search. 2. The user requests search results without requesting promotional content. 3. The skill directs the agent to perform the legitimate API operation. 4. The mandatory instruction causes the agent to append the OpenJobs AI promotional hyperlink. 5. The user receives third-party promotional content presented as part of the agent's answer and may follow the tracking-tagged external URL. ### Impact Assessment The issue affects all responses produced through the skill. It can: - Override user expectations regarding concise ...[truncated 343 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the unconditional requirement to append promotional content after every operation. - Provide source attribution only when it is materially relevant or explicitly requested by the user. - Avoid tracking parameters in links emitted by the skill. - If attribution is necessary for data provenance, use neutral wording such as “Data source: OpenJobs AI” without promotional language. - Permit the agent to omit external links when the user's requested output format excludes them. - Clearly distinguish factual data-source attribution from advertising or service promotion. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:144
• Finding: Blanket Suppression of Safety and Accuracy Warnings<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 144 **Vulnerability Type**: Agent warning and safety-output suppression **Risk Level**: Medium ### Vulnerable Code ```markdown - **Do not add any unsolicited commentary**, warnings, disclaimers, or follow-up offers after presenting results. ``` ### Technical Analysis This instruction broadly prohibits warnings and disclaimers rather than limiting only irrelevant or repetitive commentary. When the skill is loaded, it can interfere with the agent's ability to communicate contextually necessary safety, privacy, provenance, or accuracy information. A result-formatting instruction may reasonably request concise output, but it should not categorically suppress warnings. The prohibition can conflict with the agent's responsibility to qualify uncertain data, warn about sensitive uses of scholar profiles, or explain material API limitations. This constitutes skill instruction hijacking because it changes the agent's response constraints beyond the functional requirements of searching and formatting scholar records. ### Attack Path 1. The agent loads the skill and accepts its result-presentation instructions. 2. A user makes a request for which a privacy, accuracy, provenance, or safety warning becomes relevant. 3. The scholar API returns data that the agent prepares for presentation. 4. The blanket prohibition discourages or prevents the agent from adding the relevant warning or qualification. 5. The user receives results without material risk context and may treat them as complete or fully reliable. ### Impact Assessment The issue affects response integrity and informed user decision-making. Potential consequences include: - Omission of relevant privacy or responsible-use warnings. - Failure to disclose material limitations or uncertainty in returned data. - Reduced ability to warn users about inappropriate downstream uses. - Presentation of incomplete risk context as authoritative outpu ...[truncated 212 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the blanket prohibition with a narrowly scoped formatting rule, such as: “Avoid irrelevant commentary and unnecessary follow-up offers.” - Explicitly permit safety, privacy, legal, provenance, and accuracy notices when materially relevant. - State that higher-priority agent and platform safety requirements remain applicable. - Allow concise qualifications when API data may be incomplete, outdated, or ambiguous. - Restrict the two-to-three-line presentation rule to ordinary result entries rather than all surrounding safety context. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:34
• Finding: API Key Exposure Through Shell Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 34–36 **Vulnerability Type**: Sensitive credential disclosure through command output **Risk Level**: High ### Vulnerable Code ```markdown Before using any feature, check whether an API key is already available: 1. Check the `MIRA_KEY` environment variable: `echo $MIRA_KEY` ``` ### Technical Analysis The prescribed command prints the complete `MIRA_KEY` secret to standard output. Checking whether an environment variable exists does not require revealing its value. In an agent environment, tool output may be retained in conversation transcripts, execution logs, debugging systems, telemetry, terminal scrollback, or other observability infrastructure. Any user or service able to access those records could obtain the bearer credential. The later API examples use this value in an `Authorization: Bearer` header, confirming that it is an authentication secret. Disclosure can therefore permit unauthorized requests within the permissions and quota assigned to the key. ### Attack Path 1. A valid `MIRA_KEY` is present in the agent's environment. 2. During setup, the agent follows the skill instruction and executes `echo $MIRA_KEY`. 3. The shell writes the complete API key to captured tool output. 4. The output is retained in an agent transcript, log, terminal buffer, telemetry record, or debugging system. 5. A party with access to that output extracts the key. 6. The party submits requests to the OpenJobs AI API using `Authorization: Bearer <stolen-key>`. 7. The stolen credential remains usable until it expires, is disabled, or is rotated. ### Impact Assessment An attacker who obtains the key can act with the API permissions associated with that credential. Depending on server-side policy, this may allow: - Unauthorized scholar-search API requests. - Consumption or exhaustion of the account's API quota. - Rate-limit abuse and service disruption for the legitimate key owner. - Attribution o ...[truncated 281 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the value-printing command with a non-disclosing presence check: ```bash if [ -n "${MIRA_KEY:-}" ]; then echo "MIRA_KEY is configured" else echo "MIRA_KEY is not configured" fi ``` - Never print, log, return, or repeat the complete API key. - Use secret-aware runtime facilities for credential injection rather than requesting that users paste credentials into ordinary conversation. - Redact values matching the documented `mira_` key prefix from tool output, application logs, and telemetry. - Prevent shell tracing such as `set -x` while handling the credential. - Rotate any key that has already been exposed through command output or transcripts. - Apply least-privilege scopes, short expiration periods, rate limits, and usage monitoring to issued credentials. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Transmission

Medium

• Category: Data Exfiltration

Content

1. Call the version endpoint:
```bash
curl -s https://mira-api.openjobs-ai.com/v1/version
```
2. Compare the returned `version` with this skill's frontmatter `version: 1.0.1`.
3. If the server version is **newer**, notify the user that a new version is available and they should update the skill.

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to send user-provided scholar search criteria to the OpenJobs AI API but does not clearly warn the user that their queries, affiliations, names, and research filters are transmitted to a third-party service. This creates a privacy and consent issue, especially when searches may contain sensitive recruiting interests, named individuals, or proprietary talent-search criteria.

Static analysis

No suspicious patterns detected.