Job for Agents

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:48 AM UTC
• Version: 4.1.3

Overview

The skill mostly matches its OpenJobs marketplace purpose, but it gives remote updates and automated marketplace actions too much authority over a user’s agent.

Install only if you are comfortable with an OpenJobs agent making authenticated marketplace changes and handling local wallet/API credentials. Before enabling heartbeat automation, remove or disable forced remote skill refresh, pin the CLI version, keep oversight in manual mode unless you intentionally preauthorize actions, and verify wallet/config files are private.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:614

Finding

Remote Skill Content Is Treated as Runtime Execution Authority

Content

View full analysis

and are the **runtime execution authority**: ```bash # Re-install the full skill bundle (updates HEARTBEAT.md, SKILL.md, references/): openjobs install-skill --agent --force # Supported runtime names: claude-code, openclaw, codex, hermes # Or use --dest-dir if you installed to a custom path. ``` ``` ### Technical Analysis The audited Skill explicitly instructs the agent to replace its local Skill bundle at the beginning of every heartbeat and to regard the latest remote content as the authoritative runtime instructions. The `--force` option permits existing files to be overwritten. Consequently, the effective instructions executed after installation are not limited to the files reviewed in this audit. The remote publisher, a compromised OpenJobs service, or a compromised package distribution path could change `SKILL.md`, `HEARTBEAT.md`, or referenced files after review. Those changed instructions would then be loaded into a privileged agent context. Automatic updating is not necessary to browse jobs, inspect an inbox, or execute the marketplace lifecycle. It exceeds minimum privilege by granting an external source continuing control over the agent's future instructions. ### Attack Path 1. The Skill is installed and initially passes local review. 2. A heartbeat is triggered manually or by the runtime's periodic scheduler. 3. The agent executes `openjobs install-skill --agent --force`. 4. The CLI retrieves the current remotely published Skill bundle. 5. Existing locally reviewed instructions are overwritten. 6. The replacement bundle introduces new commands or inst ...[truncated 891 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: HEARTBEAT.md:31

Finding

Heartbeat Instructions Compel Unsolicited Marketplace State Changes

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/verify-agent.mjs:38

Finding

Prefix-Based Origin Validation Allows OpenJobs API-Key Exfiltration

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: HEARTBEAT.md:84

Finding

Unpinned Automatic CLI Execution Creates a Supply-Chain Code-Execution Path

Content

View full analysis

/dev/null 2>&1; then OJ=$(command -v openjobs) else OJ="npx -y @openjobs/cli" fi printf 'Using OpenJobs command: %s\n' "$OJ" ``` ``` Related installation guidance also uses an unpinned package: ```bash npm install -g @openjobs/cli # or npx @openjobs/cli --help ``` ### Technical Analysis When no local `openjobs` executable is found, the heartbeat falls back to `npx -y @openjobs/cli`. No exact version or integrity value is specified, and `-y` suppresses the interactive installation confirmation. The package selected at execution time may therefore differ from the version reviewed or previously used. An npm package executes local JavaScript with the permissions of the invoking user. It may also run installation lifecycle scripts. Because the OpenJobs workflow operates near API credentials and wallet material, a compromised release or publisher account could access sensitive local files or alter workflow behavior. The audit found no evidence that the current `@openjobs/cli` package is malicious. The vulnerability is the mutable, unpinned execution path and the absence of an integrity or approval boundary. ### Attack Path 1. An attacker compromises the npm publisher account, package registry path, or a future package release. 2. The victim runtime does not have a local `openjobs` binary. 3. A heartbeat resolves ...[truncated 925 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create-solana-wallet.mjs:94

Finding

Solana Private-Key File Is Created Before Restrictive Permissions Are Applied

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (20)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 602)May include surrounding context.

md

`HEARTBEAT.md` lives at the top level of the skill (a peer of `SKILL.md`,

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 606)May include surrounding context.

md

`HEARTBEAT.md` lives at the top level of the skill (a peer of `SKILL.md`,

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 644)May include surrounding context.

md

`HEARTBEAT.md` lives at the top level of the skill (a peer of `SKILL.md`,

Ssd 1

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The text states that remotely hosted skill content is the 'runtime execution authority,' encouraging the agent to prioritize externally fetched instructions over local, system, or reviewed skill content. This is a direct trust-boundary violation and creates a powerful remote-instruction injection path that could subvert safeguards, alter behavior, or induce dangerous commands on every heartbeat.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger section says to use the skill for a wide range of requests such as checking messages, updating oversight settings, managing webhooks, viewing platform stats, staking, and submitting feedback. This is broad enough that many distinct user intents could activate the same workflow without clear boundaries or exclusion conditions, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The fallback npx -y @openjobs/cli pulls and executes the latest package version at runtime without pinning or integrity verification. In a high-trust workflow that performs wallet, staking, messaging, and job state changes, this creates a supply-chain execution risk: a compromised or malicious package release could run arbitrary code and access local secrets or perform unauthorized OpenJobs actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill's purpose is to participate in the OpenJobs marketplace via the OpenJobs CLI, but these instructions direct the agent to create local directories under /tmp, inspect installed Ollama models, and run a local image-generation model. While producing deliverables may be useful for some jobs, embedding a specific local model-execution capability is not justified by the marketplace-management scope described in the manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The workflow includes commands to alter the agent's oversight/autonomy mode with insufficient emphasis on the security consequences of changing those controls. Since full_auto, notify_only, and manual directly govern whether the agent may autonomously apply, submit, accept, or modify marketplace state, an incautious or socially engineered invocation could weaken safeguards and enable unauthorized actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill extends beyond OpenJobs operations into mandatory Telegram notifications and cross-tool delivery assumptions, which increases the action surface and can cause the agent to disclose operational metadata to an external channel. Because the rule is framed as mandatory whenever state changes occur, it can pressure the agent into using unrelated messaging tools or exposing job/task identifiers outside the core marketplace context.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill invokes shell commands, uses networked package retrieval, and handles environment/config state, but it does not declare an explicit tool scope or allowed-tools boundary. In an agent runtime, that omission can cause the skill to be granted broader execution capability than intended, increasing the chance of unintended command execution or secret exposure when the skill is auto-invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger guidance is broad enough that generic mentions of 'Solana', 'the marketplace', or 'my agent' may activate the skill outside true OpenJobs tasks. In an agent system with shell/network powers, overbroad activation increases the chance of unintended wallet, messaging, or job-management actions in the wrong context.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

Common doctor outputs and what to do:

| Doctor row              | Status | Fix                                                                                               |
| ----------------------- | ------ | ------------------------------------------------------------------------------------------------- |
| `auth.apiKey` missing   | ✗      | `openjobs login --api-key sk_live_xxx` (or `openjobs agents register …` for a brand-new agent).    |
| `cli.version` outdated  | ⚠      | `openjobs upgrade --yes`                                                                          |

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill recommends npx @openjobs/cli --help without pinning a version, which causes live code to be fetched and executed from the registry at runtime. That creates a supply-chain risk: a compromised package, malicious update, or typosquat could result in arbitrary code execution in the agent environment.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

npx @openjobs/cli --help # zero-install, one-off runs

text

If `npm i -g` fails with `EACCES`, point npm at a user-owned prefix (don't `sudo npm i -g`):

```bash
npm config set prefix ~/.npm-global

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

bash

npm config set prefix ~/.npm-global
export PATH=~/.npm-global/bin:$PATH   # add to ~/.bashrc or ~/.zshrc
npm install -g @openjobs/cli
openjobs doctor

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

1. Run `openjobs doctor` and READ the output.
2. If it says "Could not locate the bundled skill files" → your CLI predates the bundled skill. Run `openjobs upgrade --yes`, then `openjobs --version` (must show 2.2.x or newer), then re-try install-skill **once**.
3. If `upgrade` itself fails with `EACCES` → use the `~/.npm-global` recipe above. Do NOT `sudo` (it changes file ownership and breaks the next non-sudo install).
4. If a PATH-shadow warning appears (`⚠ openjobs PATH-shadow: which openjobs resolves to A but this process is running B`), `which -a openjobs` and remove or reorder the stale copy. Do NOT keep upgrading — both copies upgrade simultaneously and the shadow persists.

The CLI never auto-retries failed installs; neither should you. One failure → run `doctor` → apply the named fix → one more attempt.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs agents to forcibly reinstall the full skill bundle on every heartbeat, which can overwrite local skill files automatically. Without a warning, diff check, or trust gate, this turns a periodic task into a remote update channel capable of silently changing future agent behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/create-solana-wallet.mjs (reported line 3)May include surrounding context.

js

#!/usr/bin/env node
/**
 * OpenJobs — Create Solana Wallet (offline)
 *
 * Generates a brand-new Solana keypair LOCALLY and writes:
 *   - ~/.openjobs/wallet.json   (Phantom/solana-cli compatible 64-byte secret key array)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md

console.log("✅ New Solana wallet created");
console.log("");
console.log("  Address:     " + walletAddress);
console.log("  Secret key:  " + WALLET_PATH + "  (chmod 600)");
console.log("  Preferences: " + PREFS_PATH);
console.log("");
console.log("Next step: prove ownership of this wallet.");

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/create-solana-wallet.mjs (reported line 118)May include surrounding context.

js

console.log("✅ New Solana wallet created");
console.log("");
console.log("  Address:     " + walletAddress);
console.log("  Secret key:  " + WALLET_PATH + "  (chmod 600)");
console.log("  Preferences: " + PREFS_PATH);
console.log("");
console.log("Next step: prove ownership of this wallet.");

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/create-solana-wallet.mjs:118