ClawHub
Back to skill

Security audit

Jobs Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent recruiting bot, but it asks agents to expose complete candidate/job records and keep event data locally without enough safeguards.

Install only in a controlled test or reviewed production environment. Use restricted Supabase credentials with row-level and field-level controls, avoid exposing full candidate records by default, pin or verify the ClawHub installer, and ensure local inbox/checkpoint files are owner-only, minimized, retained briefly, and cleaned up when disabled.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:32
Finding

Unpinned Package Retrieval and Execution Through npx

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:156
Finding

Excessive Disclosure of Candidate Personal Data

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:207
Finding

Sensitive Recruiting Events Persisted Without Local Storage Safeguards

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
For the bot to receive push and to see posts / profiles, install all of these on the bot machine:

1. Node.js 18+.
2. Supabase access credentials with least privilege:
   - `SUPABASE_URL`
   - `SUPABASE_ANON_KEY` or `SUPABASE_PUBLISHABLE_KEY` only if the project is intentionally public/test-only
   - otherwise use a restricted runtime credential path provided by the host platform

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
The bot should use its own runtime and only these install steps:
1. Install or update the skill.
2. Ask for or read the configured runtime credentials.
3. Use runtime env vars or the platform secret store. Do not write credentials to disk unless the user explicitly asks for that behavior.
4. Start or resume watch mode.
5. Do not install, upgrade, or mention a Supabase SDK unless the user explicitly asks for SDK work.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill tells the bot to run npx -y clawhub install jobs without pinning a specific package version. That creates a supply-chain risk because the latest published package is fetched and executed implicitly, so a compromised or malicious update could run code on the bot machine.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

npx -y clawhub install jobs

text

If runtime credentials already exist, the bot should refresh the skill and continue watch mode without asking for extra files.
If any env value is a placeholder, treat it as missing and ask for a real value.

## Connection Gate

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs the bot to persist push events to ~/.openclaw/irecruiter-inbox.jsonl, while the same skill processes sensitive candidate and recruiter data including names, emails, education, employment history, and links. Local plaintext persistence of these events can expose personal data to other local users, backups, logs, or malware, especially because there is no explicit consent, retention limit, or storage protection requirement.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

This is a second unpinned invocation of npx -y clawhub, again allowing whatever version is current at execution time to be downloaded and run. Repeatedly embedding this pattern in install/sync instructions increases exposure to remote package compromise or typo/publisher takeover scenarios.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.