Skills/npm/company-jobs-feed-mcp

company-jobs-feed-mcp@1.1.19

CAUTION

Publisher claims: "COMING SOON: indexed search, 8,700+ boards. Apify $5 credit. Free 135-board scan." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server) · listed in the official MCP RegistryPublisher fairquery · publishing for 29 daysInstalls 0Last detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Server started and answered tools/list.
Tested
MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with real credentials

Before you give it your token

It will ask for
APIFY_TOKENConfiguration, not credentials: CF_WORKER, FAIRQUERY_HOSTED
Where it talks to
getfairquery.com (its own)Also gem.com, apify.com, stripe.com, lever.co, ramp.com, personio.de — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names gem.com, apify.com, stripe.com, lever.co, ramp.com, personio.de as well as its own vendor. The guard injects APIFY_TOKEN only into requests to getfairquery.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets APIFY_TOKEN=getfairquery.com -- npx -y @fairquery/company-jobs-feed-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-09 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Prompting user to enter sensitive credentials. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 26 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
5.8sprocessdependency install exit 0
26sclaimed7 tools: jobs_get_board, jobs_find_board, jobs_check_open, jobs_get_job, jobs_list_seed_boards, jobs_search_by_location, jobs_search_companies
26sprocessscript backend runs setup only
26sprocessno install scripts to re-run

Static findings

MEDIUM
Process kill commanddist/index.js:104 · Process kill command — agent can terminate processes…03/429 (or an HTML block page from an ATS API) stops that host for the session (kill switch, never retried, also for the other free tools): the call does not fail bu…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/index.js:104 · File type combined with upload action — agent may exfiltrate local data files… starter list -> the company\'s own website (only for a domain/URL input; robots.txt respected, <= 3 pages, private/internal IPs refused; Personio, Pinpoint and Gem hosts are not crawled) -> at most 6 GETs against the Greenhouse, Lever and…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
CRITICAL
Prompting user to enter sensitive credentialsdist/common.js:68 · Prompting user to enter sensitive credentials — social engineeringreturn undefined; // tokens never contain whitespace; e.g. "paste your token here"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
File type combined with upload actiondist/index.js:197 · File type combined with upload action — agent may exfiltrate local data files…ocumented board feed is fetched once and the id is looked up. Personio is robots.txt then /xml. Pinpoint is robots.txt then /postings.json. Gem is GET /job_posts/ only. Pinpoint and Gem description_text stay empty. No apply URL is requeste…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commanddist/shared/ats.js:601 · Process kill command — agent can terminate processesthrow personioFeedError(host, loaded.status, `${host} returned HTML instead of postings.json; host stopped (kill switch).`, 'HOST_BLOCKED', true);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/shared/http.js:166 · Process kill command — agent can terminate processesthrow new HttpError(`${host} answered HTTP ${res.status}; scanning of this host stopped for the run (kill switch).`, 'HOST_BLOCKED', true, res.status, host);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/shared/http.d.ts:124 · Process kill command — agent can terminate processes* and 403 is the kill switch). No API key. Redirects are not followed.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/shared/http.d.ts:11 · Process kill command — agent can terminate processes* Per-host politeness + kill switch. At most HOST_CONCURRENCY requests in flight per host and an optionalFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/shared/http.js:220 · Process kill command — agent can terminate processesthrow new HttpError(`${host} answered HTTP ${res.status}; scanning of this host stopped for the run (kill switch).`, 'HOST_BLOCKED', true, res.status, host);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/index.js:197 · Process kill command — agent can terminate processes…rtial row. Nothing is stored. Any HTTP 403/429 stops that host for the session (kill switch, HOST_BLOCKED). Lever requests are spaced 1 s apart. Personio accounts sh…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/index.js:51 · Process kill command — agent can terminate processes…n_at = now and change = null. Any HTTP 403/429 stops that host for the session (kill switch, HOST_BLOCKED error). A blocked Personio or Pinpoint host does not block …Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/index.js:51 · File type combined with upload action — agent may exfiltrate local data files…ost only (very large Greenhouse boards: a second, lighter GET). Personio: robots.txt, then GET https://{account}.jobs.personio.de/xml only; all Personio accounts share one lane, one at a time, at least 1.5 s apart. Pinpoint: that tenant\'s…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commanddist/shared/http.js:27 · Process kill command — agent can terminate processes* Per-host politeness + kill switch. At most HOST_CONCURRENCY requests in flight per host and an optionalFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/index.js:135 · File type combined with upload action — agent may exfiltrate local data files…etched once and searched for the id (method "board_listing"). Personio is robots.txt then /xml. Pinpoint is robots.txt then /postings.json. Gem is GET /job_posts/ only. No apply URL is requested. "open" means currently published by the emp…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commanddist/index.js:282 · Process kill command — agent can terminate processes…ty countries list, or remote "only". Reads starter boards with the same client, kill switch and rate limits as the other free tools (at most 2 requests in flight per…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/shared/http.js:187 · Process kill command — agent can terminate processesthrow new HttpError(`${host} returned HTML instead of JSON; host stopped (kill switch).`, 'HOST_BLOCKED', true, res.status, host);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/shared/ats.js:550 · Process kill command — agent can terminate processesthrow personioFeedError(host, loaded.status, `${host} returned HTML instead of the XML feed; host stopped (kill switch).`, 'HOST_BLOCKED', true);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/shared/gem.d.ts:15 · Process kill command — agent can terminate processes* This client does not request robots.txt: a 403 is the kill switch and would stopFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/shared/ats.js:651 · Process kill command — agent can terminate processesthrow personioFeedError(host, loaded.status, `${host} returned HTML instead of job_posts JSON; host stopped (kill switch).`, 'HOST_BLOCKED', true);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/shared/pinpoint.js:46 · File type combined with upload action — agent may exfiltrate local data files* Fetch one named subdomain's feed: robots.txt, then /postings.json if allowed.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/shared/pinpoint.js:47 · File type combined with upload action — agent may exfiltrate local data files* `io.get` is not called when robots.txt disallows /postings.json or cannot be read.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/shared/pinpoint.js:29 · File type combined with upload action — agent may exfiltrate local data filesconst hostOk = path === '/postings.json' ? isPinpointPostingsPath(u.pathname) : got === '/robots.txt';Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commanddist/shared/http.js:240 · Process kill command — agent can terminate processesthrow new HttpError(`${host} returned HTML instead of JSON; host stopped (kill switch).`, 'HOST_BLOCKED', true, res.status, host);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/shared/types.d.ts:199 · Process kill command — agent can terminate processes* HTTP 403/429 still kill the host and are not retried. A second failure is aFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/shared/pinpoint.d.ts:57 · File type combined with upload action — agent may exfiltrate local data files* `io.get` is not called when robots.txt disallows /postings.json or cannot be read.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/shared/pinpoint.d.ts:56 · File type combined with upload action — agent may exfiltrate local data files* Fetch one named subdomain's feed: robots.txt, then /postings.json if allowed.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/shared/pinpoint.js:57 · File type combined with upload action — agent may exfiltrate local data filesthrow new HttpError(`robots.txt on ${host} disallows /postings.json`, 'ROBOTS_DISALLOWED', false, undefined, host);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commanddist/shared/types.js:282 · Process kill command — agent can terminate processes* HTTP 403/429 still kill the host and are not retried. A second failure is aFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈107 tok
1 file · 42 in bundle
Tool list per prompt
≈10,397 tok
7 tools · 1485 per tool
Handshake
1142 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 3572

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @fairquery/company-jobs-feed-mcp@1.1.19 as of 5d ago. This is the package itself, not its dependencies.

What would make this Verified

2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Prompting user to enter sensitive credentials≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim fairquery: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim fairqueryPropose a patch to the maintainer