Skill

salary-market-scanner

skill:tinyfish-io/tinyfish-cookbook#salary-market-scanner

Scan live job boards and salary databases to find real-time compensation data for any role and location. Use this skill when a user asks "what's the going rate for a senior React engineer in London", "software engineer salary Singapore", "how much do ML engineers make", "what should I be earning as a [role]", "is my salary competitive", "what does [company] pay for [role]", "salary range for [job title] in [city]", or any request to find out what a role pays in a specific market.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 23:00 UTC at 78b7c33

findings

medium

highest severity

threat classes

1,446

files scanned

20/20

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/salary-market-scanner:skills/salary-market-scanner/SKILL.md:20:SUPPLY

Security findings 1

Supply chain

mediumContextual risklow confidence

The skill gates all task work behind a REQUIRED pre-flight that stops the agent and steers the user into globally installing an unpinned third-party npm package (`@tiny-fish/cli`) plus an external TinyFish API key, an infrastructure dependency nowhere disclosed in the skill's declared description of scanning job boards.

skills/salary-market-scanner/SKILL.md:20

Install the TinyFish CLI: `npm install -g @tiny-fish/cli`

vector:instruction

Counter-argument considered

The REQUIRED pre-flight is fully evidenced in the agent-read skill body and steers every run toward an unpinned global npm install of @tiny-fish/cli plus an external key; an unpinned install falls outside the pinned-official-registry carve-out, and the declared description (SRC:0b4d7e0b8cf5dc9e) names no TinyFish/npm dependency, so undeclared stands. Mitigation is partial only: the agent relays the install to the user rather than executing it itself, which lowers severity but does not neutralize the steering, so the low-confidence contextual_risk finding survives.