Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed remote-job-search helper, but users should be careful with its broad activation wording and email credential setup.
Install only if you want an agent to help search remote jobs and possibly configure daily email reports. Confirm before enabling scheduled runs, avoid storing SMTP passwords in plain JSON when possible, and treat resume/profile details and job preferences as personal data.
The trigger list is broad enough to activate on common conversation about jobs or remote work, which can cause the agent to invoke this skill unexpectedly. Because the skill can launch scripts that search external sources, read configuration, and potentially send email, accidental invocation could expose user data or perform actions the user did not clearly request.
The skill explicitly describes emailing reports and storing SMTP credentials in configuration, but it does not warn that this involves handling sensitive personal data such as email addresses, job preferences, and authentication secrets. In this context, users may be prompted to place credentials in a local JSON file or transmit job-match data by email without understanding the privacy and secret-management risks.
The 'When to Use' section defines activation using vague requests like asking about job opportunities or mentioning 'remote work', without boundaries that distinguish casual discussion from an execution request. In an agent environment, ambiguous routing increases the chance that the skill runs during normal conversation and initiates network actions or email workflows without sufficiently specific consent.
No suspicious patterns detected.
