ClawHub
Back to skill

Security audit

JD - Triage

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local job-description triage assistant that stores career criteria and evaluation history as disclosed local Markdown files, with no evidence of code execution, network access, credential use, or deception.

Install only if you are comfortable keeping job-search criteria, compensation floors, locations, skills, and evaluation summaries in local files under ~/.openclaw/workspace. Keep that workspace private, avoid full raw-JD history for confidential recruiter messages, and review or delete the Markdown files if you no longer want that history retained.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
Findings (13)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/history.md (reported line 131)May include surrounding context.

md
The file grows without bound by design — `analyze` gets better with more rows.
If it passes roughly 100 entries and the user asks, offer to archive entries
older than a year to `jd_history_<year>.md` rather than deleting them. Never
delete history unprompted.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · references/scoring.md (reported line 100)May include surrounding context.

md
**Unknown organizations.** If you have no reliable knowledge of an anchor, that
changes nothing: the `why` is the comparison basis, and it always was. Never
substitute a reputation for the user's stated reason — that is how the axis drifts
away from the person it is supposed to represent. Equally, never refuse to score
because an anchor is obscure.

### Comp fit — `comp_floor`, `profile.current_comp`

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly persists criteria and evaluation history to local files, but the specification does not require an upfront user notice or consent before storing potentially sensitive career preferences, compensation floors, locations, and job-search history. This creates a privacy and consent risk, especially because the writes are framed as automatic responsibilities and 'the evaluation is not complete until this write succeeds.'

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list includes broad natural-language phrases such as 'should I apply' and similar equivalents, which can cause the skill to activate on ordinary career discussion rather than an explicit request. Unintended invocation is dangerous here because the skill reads and writes persistent user files, so an accidental match can lead to silent profile updates, history logging, or analysis of sensitive job-search data without clear user intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The skill persists user data to a fixed path under the home directory, creating session persistence across runs. In this context the stored content includes compensation floors, locations, red lines, skills, and target roles, so unintended retention or access by other local processes/users could expose sensitive personal and career information.

Content

Scanner excerpt · references/bootstrap.md (reported line 12)May include surrounding context.

md
| **Derive from examples** | `/jd-triage learn`, or offered when a profile is thin | Paste a few JDs |
| **Full** | S5 (`update` / `reset`), or user asks | All fields |

Write to `~/.openclaw/workspace/jd_criteria.md` using `assets/criteria-template.yaml`.
Field keys English; values in the user's language.

## Using presets

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly instructs writing a criteria profile to a persistent file in the user's home directory, but the skill description does not clearly disclose that local profile data will be stored there. This creates a privacy and consent issue because users may provide sensitive career, compensation, and location data without understanding it will be persisted beyond the current interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The just-in-time capture flow says to collect additional skills, org traits, anchors, and intensity data and write them to disk inline, but it does not require a clear point-of-collection disclosure or explicit consent for each new persistence event. This is dangerous because it can silently expand the stored profile with increasingly sensitive preference and employability data over time.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/bootstrap.md (reported line 145)May include surrounding context.

md
## Migration

Triggered by S2 (`schema_version` < 3). Migrate everything inferable **without
asking**, then ask only for what cannot be derived. Show a summary of what
changed before writing.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill mandates creation of a persistent append-only history file and requires writing every evaluation, including rejections, without any baseline opt-in or prior warning. Because job descriptions and recruiter messages can contain sensitive personal, company, or contact information, automatic persistence creates a real privacy and data-retention risk even if the feature is intended for user benefit.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions require persistent logging of all evaluations and explicitly preserve free-text summaries, citations, and quotes from job materials. That creates a genuine data-retention and confidentiality risk because pasted recruiter messages and job descriptions may contain personal contact data, internal hiring notes, or other sensitive text that will accumulate over time in a local file.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Full mode stores complete job postings verbatim, and the file itself acknowledges this may include recruiter contact details or compensation not published elsewhere. Although there is a one-time warning, continuing to store raw postings indefinitely still increases the risk of retaining third-party personal data and sensitive business information beyond what is necessary for the skill's purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The instruction says to use this preset "when no other preset fits" or when the user's field is outside tech, but it does not define concrete boundaries or exclusions for those cases. As a manifest-style YAML file, this lacks specificity on trigger scope and could lead to the preset being invoked for many generic requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file states that structural labels are "always English," which forces a specific language choice rather than offering user selection. Although a justification is provided for grepability, there is no indication of user opt-in or configurability, so this is a natural-language locale policy issue under the stated rule.

Content

No source excerpt is available for this finding.