Placed Job Tracker

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:27 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent Placed job-tracking integration, but it handles a long-lived API key unsafely and allows deletion of job records without documented safeguards.

Install only if you are comfortable trusting placed.exidian.tech with your job application data and notes. Prefer setting PLACED_API_KEY only in your environment or a secret manager; if you use the file, restrict it to owner-only permissions and avoid sourcing writable credential files. Ask the agent to list and confirm the exact job record before any delete action.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:16

Finding

Unsafe Shell Sourcing and Plaintext Persistence of API Credentials

Content

View full analysis

" > "$HOME/.config/placed/credentials" export PLACED_API_KEY= ``` ### Technical Analysis The Skill saves the Placed API key as plaintext in `~/.config/placed/credentials` without explicitly applying restrictive permissions to either the directory or the file. The resulting access permissions depend on the user's current `umask`, which may allow unintended local disclosure. More critically, the Skill later loads this file using the shell built-in `source`. Sourcing does not merely read the expected `PLACED_API_KEY` assignment; it executes every shell statement in the file in the current shell context. If another local account, process, compromised program, or synchronization mechanism can modify the credential file, it can insert arbitrary shell commands that execute when the Skill is used. Reading a dedicated Placed credential is reasonably related to authenticated API access. However, persisting it without explicit permission controls and treating the data file as executable shell code exceed the minimum privileges and behavior needed for the declared job-tracking functionality. ### Attack Path 1. The user invokes the Skill and supplies a Placed API key. 2. The Skill writes the key in plaintext to `~/.config/placed/credentials` without explicitly setting mode `600`. 3. An attacker who has gained write access to that file replaces or augments it with a command, for example: ```bash export PLACED_API_KEY="..." malicious_command ``` 4. In a later session, `PLACED_API_KEY` is absent from the envi ...[truncated 1177 chars]

Remediation

View remediation

"$HOME/.config/placed/credentials" chmod 600 "$HOME/.config/placed/credentials" ``` 4. Store only the token value rather than executable shell syntax such as `export ...`. 5. When reading the token, verify that the file is a regular file owned by the current user and is not a symbolic link. Reject files with group or world permissions. 6. Avoid placing the token directly in generated command text, logs, diagnostics, or shell history. Pass it through the environment or a protected descriptor and redact it from errors. 7. Support environment-only authentication as the default so persistent credential access is not required. 8. Document token revocation and rotation procedures for users whose credential file may have been exposed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

placed_call() {
  local tool=$1
  local args=${2:-'{}'}
  curl -s -X POST https://placed.exidian.tech/api/mcp \
    -H "Authorization: Bearer $PLACED_API_KEY" \
    -H "Content-Type: application/json" \
    -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"$tool\",\"arguments\":$args}}" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill tells the user to persist the API key in a plaintext shell file under ~/.config/placed/credentials and to source it later, without any warning about filesystem exposure or file permissions. This increases the chance that other local users, backups, logs, or accidental disclosure will expose a long-lived credential that can be used to access the user's job application data.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The skill sends user-supplied job application data and the bearer API key to an external service at placed.exidian.tech. External transmission is inherent to the skill's purpose, but it still creates real confidentiality risk because sensitive career data and authentication material leave the local environment and the skill does not clearly bound, minimize, or warn about that exposure.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

placed_call() {
  local tool=$1
  local args=${2:-'{}'}
  curl -s -X POST https://placed.exidian.tech/api/mcp \
    -H "Authorization: Bearer $PLACED_API_KEY" \
    -H "Content-Type: application/json" \
    -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"$tool\",\"arguments\":$args}}" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The markdown includes a delete_job_application example, but there is no accompanying caution about deletion impact or whether the action is reversible. For markdown skills, SQP-2 requires warnings when behaviors could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The API reference documents a destructive delete_job_application operation but provides no guidance to require explicit user confirmation, preview the target record, or use safeguards against accidental deletion. In an agentic context, this increases the risk that a model could delete a user's job application based on ambiguous instructions or mistaken ID selection, causing loss of tracking data and workflow disruption.

Content

No source excerpt is available for this finding.