Security audit

Job Search Tracker

Security checks for vulnerabilities and agentic risk

Overview

This job-search tracking skill is coherent and disclosed, with sensitive but purpose-aligned local tracking and optional Gmail, LinkedIn, browser, and web-search use.

Install only if you are comfortable keeping job-search history, recruiter contacts, salary ranges, and offer details in a local tracker. Leave Gmail or LinkedIn tools disconnected for tracker-only use, and require explicit confirmation before the assistant writes externally discovered items or logs follow-ups.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill says LinkedIn lookups are optional and user-mediated, but then instructs the assistant to perform company research regardless, including falling back to web search when LinkedIn is unavailable. That creates a scope-expansion problem: users may believe external lookups only occur when explicitly requested, while the skill authorizes autonomous third-party queries that can expose sensitive job-search context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The follow-up workflow permits tracker modification if the user 'confirms (or doesn't object),' which treats silence as consent. This is unsafe because it allows persistent changes to personal records without explicit authorization, increasing the risk of inaccurate records, unwanted data retention, or tool-driven overreach.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 418)May include surrounding context.
md
- **Tool-mediated reads**: When the skill instructs the assistant to search Gmail, browse LinkedIn, or run a web search, those requests go through tools the user has explicitly connected, under the user's own credentials and permissions. Revoking access to a tool stops the related behavior. - **Confirmation before writes from external sources**: When the assistant finds candidate applications via Gmail or LinkedIn, it must present the findings to the user and wait for explicit confirmation before adding entries to the tracker. Silent ingestion is not allowed. - **Sensitive fields stay scoped**: Salary figures, offer details, and recruiter contact information belong in the tracker file. The assistant should not paste these into drafts, summaries, or third-party-bound messages unless the user has asked for that specific output. - **No destructive operations without consent**: The assistant must not delete entries, overwrite notes, or modify resumes without explicit user confirmation. - **No telemetry by the skill**: The skill does not collect or transmit usage data, file contents, or any other information back to its author, ClawHub, or any third party. (Connected tools may have their own logging — the user should consult those tools' policies.) **What a cautious user should know before installing**

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 429)May include surrounding context.
md
## Important Notes - The tracker is the user's data. Don't delete entries or overwrite notes without asking. - When in doubt about a status change, ask: "Should I mark this as [status]?" - Keep the emotional temperature right. Job searching is stressful. Be practical and supportive without being syrupy. A rejection is a data point, not a crisis; an offer is exciting, not a reason for five paragraphs of congratulations. - Gmail and LinkedIn access depend on what tools are available. The skill should work well even with zero integrations, just from what the user tells you directly. The integrations are a bonus, not a requirement.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file contains conflicting privacy rules: one section says sensitive fields should remain in the tracker and not appear in drafts or summaries unless requested, while other workflow sections direct generation of summaries, dashboards, and negotiation drafts that may naturally include recruiter identities, salary, or offer terms. This inconsistency can cause accidental disclosure of sensitive employment data into outputs that are easier to share or send onward.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file stores real-looking recruiter/contact names, email addresses, and detailed job-search history in a local markdown tracker without any privacy guidance, minimization, or protection expectations. If this skill exposes, syncs, summarizes, or reuses the file content in prompts or external integrations, it could leak personal data and sensitive employment-seeking context to unintended recipients or third-party services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This section includes another personal email address alongside application-status and recruiter-interaction history, creating a concentrated set of sensitive personal and professional data. In the context of a job-search skill that may draft emails, perform lookups, or reference tracker context, the absence of privacy safeguards increases the chance of inadvertent disclosure or over-sharing.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.