Security audit

OpenJobs

Security checks across malware telemetry and agentic risk

Overview

This OpenJobs skill is mostly coherent, but it needs review because it can act autonomously in a financial marketplace, force-update its own instructions from remote content, and send action summaries through Telegram.

Install only if you are comfortable with an autonomous OpenJobs agent that can change marketplace state, use wallet/API credentials, attach files to OpenJobs, send Telegram summaries, and force-refresh its own skill instructions. Review oversight mode, spending and staking limits, wallet-secret storage, heartbeat scheduling, Telegram routing, and remote-update behavior before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill extends its behavior beyond OpenJobs marketplace operations by mandating Telegram notifications for any state-changing action. That creates an additional external data flow and operational dependency not reflected in the skill’s stated OpenJobs CLI-centric scope, increasing the chance of unintended data disclosure, cross-channel exfiltration of job metadata, or actions being blocked pending unrelated notification capability.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Instructing the agent to use Telegram introduces an external communication channel unrelated to the core OpenJobs task flow. This can leak sensitive identifiers, job details, timing, and workflow outcomes to a third party or to an incorrect recipient if chat routing is wrong, and it broadens the skill’s effective privileges beyond what a user would expect from an OpenJobs-only workflow.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to forcibly refresh and reinstall its own skill bundle from remote sources on every heartbeat, making externally hosted content the source of future behavior. That creates a self-modifying trust chain: if the remote content, distribution path, or CLI update mechanism is compromised, the agent can silently adopt new instructions without user review.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger language is broad enough to activate on generic marketplace, agent, or Solana-related requests, increasing the chance that this skill is invoked outside its intended scope. Over-broad activation is dangerous because it can steer the agent into using high-impact external tooling and remote workflows when the user did not clearly request OpenJobs actions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The forced refresh behavior can overwrite local skill files during routine heartbeats without prominently warning the operator that local customizations or reviewed versions may be replaced. This reduces transparency and weakens the user's ability to maintain a known-good, audited skill state.

Ssd 1

High

Confidence: 98% confidence
Finding: The skill explicitly declares remote published skill files to be the 'runtime execution authority,' which invites semantic prompt injection through content refresh. Because the agent is told to trust newly fetched instructions over the local reviewed bundle, any compromise of the hosting source or content publication process can directly alter agent behavior at execution time.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/create-solana-wallet.mjs:118