Skills
skills/athina-ai/goose-skills/job-posting-intent/Gen Agent Trust Hub

job-posting-intent

Fail

Audited by Gen Agent Trust Hub on Mar 14, 2026

Risk Level: HIGHCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The scripts scripts/create_sheet.py, scripts/create_sheet_mcp.py, and scripts/search_jobs.py contain a hardcoded JWT token assigned to the RUBE_TOKEN variable. This token provides authentication for the Rube API and its presence in the code exposes the associated vendor account to potential misuse.
  • [REMOTE_CODE_EXECUTION]: The skill uses the RUBE_REMOTE_WORKBENCH tool to execute Python code on a remote server. The code is constructed dynamically within the scripts using string interpolation of data retrieved from job searches.
  • Evidence found in scripts/create_sheet_mcp.py and scripts/search_jobs.py where workbench_code is defined and passed to the tool execution functions.
  • [EXTERNAL_DOWNLOADS]: The skill performs network requests to the Apify API (api.apify.com) to retrieve job posting data from LinkedIn.
  • [DATA_EXFILTRATION]: Job-related data and company insights extracted by the skill are transmitted to the rube.app service via API calls to populate Google Sheets.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Mar 14, 2026, 06:02 PM