freelance-gig-finder
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions include shell commands for environment verification, authentication status checks, and the execution of parallel search agents via the tinyfish CLI.
- [EXTERNAL_DOWNLOADS]: The skill directs users to install the @tiny-fish/cli package from the npm registry, which is a required external dependency provided by the skill author.
- [PROMPT_INJECTION]: The skill is designed to ingest data from untrusted external websites (job boards), creating a surface for potential indirect prompt injection attacks.
- Ingestion points: Job search result pages from Upwork, Contra, We Work Remotely, Freelancer.com, and LinkedIn.
- Boundary markers: No specific delimiters or instructions to ignore embedded commands are included in the scraper agent prompts.
- Capability inventory: The skill can execute CLI tools and manage local temporary files in the /tmp directory.
- Sanitization: Scraped data is processed and presented without explicit validation or sanitization layers.
Audit Metadata