ClawHub
Back to skill

Security audit

Job Applications

Security checks for vulnerabilities and agentic risk

Overview

This job-application automation is mostly purpose-aligned, but it needs review because it auto-submits personal data and tells the agent to request login secrets through Discord.

Review this skill before installing. It should not ask for passwords or verification codes in Discord; complete authentication directly on the official sites instead. Use review-only or per-application approval if possible, limit where personal data is submitted, restrict access to the local resume and tracking files, and harden the LaTeX generation script before using untrusted or agent-generated resume content.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:97
Finding

Authentication Credentials and Verification Codes Requested Through Discord

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/tailor_resume.py:66
Finding

LaTeX Command Injection Through Unescaped Backslashes in Resume Data

Content
View full analysis
str: """Escape special LaTeX characters.""" if not text: return "" replacements = { '&': r'\&', '%': r'\%', '$': r'\$', '#': r'\#', '_': r'\_', '{': r'\{', '}': r'\}', '~': r'\textasciitilde{}', '^': r'\^{}', } for char, replacement in replacements.items(): text = text.replace(char, replacement) return text ``` The generated document is subsequently passed to `pdflatex`: ```python def compile_pdf(tex_path: str, output_dir: str) -> str: """Compile LaTeX to PDF. Returns path to PDF or raises.""" result = subprocess.run( ["pdflatex", "-interaction=nonstopmode", "-output-directory", output_dir, tex_path], capture_output=True, text=True, timeout=30 ) pdf_path = os.path.join(output_dir, Path(tex_path).stem + ".pdf") if os.path.exists(pdf_path): return pdf_path raise RuntimeError(f"PDF compilation failed:\n{result.stdout}\n{result.stderr}") ``` ### Technical Analysis `escape_latex()` escapes several special characters but does not escape the backslash character. Backslashes introduce LaTeX control sequences, so a malicious value in any processed resume field can inject commands into the generated `.tex` document. The script accepts an arbitrary JSON file through the `input_json` command-line argument. Fields from that document are interpolated into the template after passing through the incomplete escaping function. The resulting document is then compiled by `pdflatex`. Using an argument array for `subprocess.run()` prevents operating-system shell injection, but it does not prevent injection into the LaTeX int ...[truncated 1664 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/tailor_resume.py:205
Finding

Path Traversal and Arbitrary File Overwrite Through Unsanitized Output Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill stores structured resume data, generated tailored resumes, logs, and application history on disk, but does not warn about local persistence of sensitive personal and employment information. In this job-application context, those files can reveal identity data, work history, target employers, and job-search activity, increasing exposure if the host is shared, backed up insecurely, or later accessed by other tools/users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill automates submission of highly sensitive personal candidate data, including contact details and tailored resumes, to multiple third-party job platforms without any explicit user warning or consent language about external transmission. In this context, the omission is meaningful because the workflow is designed to repeatedly upload PII to external services and could cause privacy, compliance, or reputational harm if the user is unaware or the configuration is mis-scoped.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/tailor_resume.py (reported line 189)May include surrounding context.

python
def compile_pdf(tex_path: str, output_dir: str) -> str:
    """Compile LaTeX to PDF. Returns path to PDF or raises."""
    result = subprocess.run(
        ["pdflatex", "-interaction=nonstopmode", "-output-directory", output_dir, tex_path],
        capture_output=True, text=True, timeout=30
    )

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file encodes an explicit religion-based exclusion rule: a job was skipped because the company is associated with lending and marked 'HARAM'. This creates a non-neutral decision policy based on a protected religious criterion without any indication of explicit user opt-in, which can lead an agent to make discriminatory filtering decisions and mishandle sensitive belief data in future automation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The cron schedule is specified only in Central Time (CT), which imposes a locale-specific operating assumption in natural language. The file does not indicate that the timezone is configurable, user-selected, or justified as a region-specific requirement.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The JSON includes direct personal contact information such as full name, email, phone number, website, and city-level address in a broadly reusable data file with no evident access controls or scoping. While common in a resume context, this still creates a privacy exposure risk because any consumer of the file can extract and redistribute the data for spam, phishing, profiling, or unwanted contact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.