AI Job Hunter

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:45 AM UTC
• Version: 1.0.0

Overview

This job-search skill is limited to fetching and displaying public job listings, with privacy and untrusted-link cautions users should review before use.

Before installing, understand that job listing content comes from an external source and links may be misleading. Review any generated cover letters or profile-based text before sharing them, especially if your USER.md contains personal contact details, employment history, or other sensitive information.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: hunt.js:12

Finding

Unsanitized Remote Job Data Rendered as Markdown Output

Content

View full analysis

Vulnerability Details

File Location: hunt.js, lines 12-18 and 47-51
Vulnerability Type: Untrusted remote-content injection
Risk Level: Medium

Vulnerable Code

js

title: j.position,
company: j.company,
salary: j.salary_min ? `$${j.salary_min}-${j.salary_max}` : 'Not specified',
url: j.url,
tags: j.tags || [],
date: j.date

js

function formatOutput(jobs) {
  if (jobs.length === 0) return 'No matching jobs found.';
  
  return jobs.slice(0, 10).map((job, i) => 
    `${i+1}. **${job.title}** @ ${job.company}\n   💰 ${job.salary}\n   🔗 ${job.url}`
  ).join('\n\n');
}

Technical Analysis

The skill obtains job records from https://remoteok.com/api and accepts the remote position, company, salary, and URL fields without validation or sanitization. formatOutput() then interpolates these fields directly into Markdown-like output.

Because the API response is outside the skill's trust boundary, a malicious listing or compromised upstream feed can supply Markdown metacharacters, deceptive links, instruction-like text, or terminal control characters. The resulting content may alter how the output is displayed or be interpreted as instructions by a downstream AI agent.

This does not directly execute operating-system commands in the audited implementation. Exploitation depends on attacker influence over the remote feed and on how the generated output is rendered or consumed.

Attack Path

1. An attacker publishes a crafted job listing on the supported service or compromises the upstream API.
2. The listing places malicious content in a rendered field such as position, company, or url.
3. fetchJobs() downloads the listing from the RemoteOK API.
4. The source parser copies the attacker-controlled fields into local job objects without validation.
5. formatOutput() inserts those values verbatim into Markdown-like output.
6. A Markdown renderer, terminal, ...[truncated 740 chars]

Remediation

View remediation

Remediation Suggestions

• Treat every field received from the job API as untrusted data.
• Strip ANSI escape sequences and other nonessential control characters.
• Escape Markdown metacharacters in job titles, company names, and salary values before rendering.
• Parse URLs with new URL() and permit only approved schemes, preferably https:.
• Consider restricting links to expected domains or clearly label external destinations.
• Apply reasonable length limits and type checks to every remote field.
• Keep remote records structurally separated from agent instructions and explicitly identify them as untrusted data.
• If output is consumed by another agent, use a structured format such as validated JSON rather than instruction-like free text.
• Add tests containing crafted Markdown links, embedded instructions, control characters, malformed URLs, and oversized fields.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly states it will generate personalized cover letters and use profile data from ~/.openclaw/workspace/USER.md, but it does not warn the user that sensitive personal information may be incorporated into generated application materials or sent to third-party job platforms. This creates a privacy and consent risk because users may unintentionally disclose personal details, employment history, contact data, or other profile content in outputs intended for external submission.

Content

No source excerpt is available for this finding.