ClawHub
Back to skill

Security audit

JobGPT

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent JobGPT automation, but it needs review because it can submit real job applications and relies on unpinned MCP install commands without enough safety gates.

Install only if you trust JobGPT and are comfortable giving the MCP server access to your JobGPT API key, resume, profile, salary, and application data. Before using auto-apply, require the agent to show the exact jobs, resume/materials, credits, and whether the automation will continue through a saved job hunt; pin or otherwise verify npm package versions where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:22
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:22-26, README.md:12-15, and README.md:31-34
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

SKILL.md:22-26:

markdown
3. **Add the MCP server** — Run the following to add the JobGPT MCP server:
   - Claude Code: `claude mcp add jobgpt -t http -u https://mcp.6figr.com/mcp --header "Authorization: <api-key>"`
   - Other tools: Add `jobgpt-mcp-server` as an MCP server with env var `JOBGPT_API_KEY` set to the API key. Install via `npx jobgpt-mcp-server`.

README.md:12-15:

markdown
**Vercel Skills.sh**
```bash
npx skills add 6figr-com/skills
text

`README.md:31-34`:

```markdown
```bash
npx jobgpt-mcp-server
text

### Technical Analysis

The installation instructions invoke npm packages through `npx` without specifying an exact package version or verifying a package integrity hash. Consequently, these commands resolve and execute whatever package release the npm registry serves at installation time, rather than a release whose contents were reviewed together with this repository.

This creates a supply-chain trust boundary because npm packages can execute JavaScript locally and may invoke lifecycle or runtime code. The effective implementation can therefore change after the Skill itself has been audited. A compromise of the package publisher, npm account, package distribution process, or a future package release could turn the documented installation procedure into an arbitrary code-execution channel.

The risk is particularly relevant for `jobgpt-mcp-server` because the resulting process is expected to receive the `JOBGPT_API_KEY` environment variable and handle sensitive career-related information.

### Attack Path

1. An attacker compromises the npm publisher account, release pipeline, or another distribution component associated with one of the referenced pack
...[truncated 1487 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every npm dependency to an exact, reviewed version rather than relying on the latest registry release. For example:

    bash
    npx jobgpt-mcp-server@<reviewed-exact-version>
npx skills@<reviewed-exact-version> add 6figr-com/skills

  2. Publish and verify expected package integrity hashes or signed provenance before execution.

  3. Use a committed lockfile when installing the MCP server as part of a local project, and require reproducible, lockfile-enforced installation in deployment workflows.

  4. Disable npm lifecycle scripts where they are not required, such as by using --ignore-scripts, after confirming that this does not prevent legitimate package operation.

  5. Document the expected npm publisher, source repository, package version, and verification procedure so users can detect package substitution or ownership changes.

  6. Run the MCP server with least privilege in an isolated environment. Limit filesystem access, network access, and exposed environment variables to those strictly required.

  7. Store the API key in an appropriate secret manager and rotate it immediately if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The auto-apply workflow instructs the agent to enable auto-apply and call apply_to_job without requiring a conspicuous warning or explicit per-action confirmation that real applications will be sent on the user's behalf. This is dangerous because it can submit real-world job applications, share personal information and resumes, and spend credits with potentially irreversible reputational consequences.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The README instructs users to run npx skills without a pinned version, which can pull the latest package at execution time and creates a supply-chain risk if a malicious or compromised release is published. Because this is installation guidance for agent tooling, users may execute it directly with high trust and little review.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 23)May include surrounding context.

text

**Manual**
Copy `SKILL.md` to your agent's skills directory (e.g., `~/.claude/skills/jobgpt/SKILL.md`).

## Requirements

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 23)May include surrounding context.

text

**Manual**
Copy `SKILL.md` to your agent's skills directory (e.g., `~/.claude/skills/jobgpt/SKILL.md`).

## Requirements

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The command npx jobgpt-mcp-server fetches and runs the latest published package version, exposing users to dependency confusion or malicious-update risk. Since this package is the MCP server backing automation features, compromise could affect job application data, credentials, or outbound actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README promotes auto-apply behavior and direct job application submission without any warning that the tool may perform real external actions on the user's behalf. In this context, an agent could submit unintended applications, send inaccurate materials, or act without adequate human confirmation, causing reputational and privacy harm.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill description is extremely broad and can trigger on many generic job-help requests, causing the agent to invoke a high-impact automation skill in situations where the user may only want advice. Because this skill can search, import, generate documents, and apply to jobs, overbroad activation raises the chance of unintended actions involving personal data or external systems.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The setup instructions tell users to install and run an MCP server via npx jobgpt-mcp-server without pinning a specific version. That creates a supply-chain risk because future package updates or a compromised package release could change behavior or introduce malicious code at install/run time. In this context, the MCP server may handle sensitive job-search data and credentials, which increases the practical risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The import workflow allows importing arbitrary external job URLs and then optionally triggering auto-apply, but it does not require a safety warning or explicit confirmation before acting on that URL. In practice, this can cause the agent to process untrusted external links and move directly toward submitting applications, increasing the risk of unintended applications, privacy exposure, and misuse of credits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.