Security audit

job-hunt

Security checks for vulnerabilities and agentic risk

Overview

The skill is largely a real job-search assistant, but its daily-browser automation grants sensitive authenticated browser access that is broader than the plain description suggests.

Review before installing if you are not comfortable giving the skill access to your logged-in daily browser. Prefer a separate browser profile or pasted job descriptions for sensitive accounts, and treat the generated local profile/workspace folders as private career data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (441)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The code is not related to job discovery, resume generation, cover-letter writing, application assessment, or interview rehearsal. Its primary purpose is browser/Electron automation through the Chrome DevTools Protocol. It accesses local debugging endpoints, browser targets, cookies, network traffic, screenshots, and console messages—capabilities not declared in the skill description. This is a material purpose and capability mismatch rather than a mere supporting implementation detail.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about job search and application assistance, but the supplied code contains no job-related logic at all. Instead, it performs a technical browser transport health check using CDP, verifies access to a task-owned blank tab, and formats a diagnostic report for a CLI doctor command. This is a materially different primary purpose and introduces undeclared capabilities related to browser diagnostics. Therefore, the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code does not implement job discovery, job assessment, resume/CV tailoring, cover-letter generation, interview rehearsal, or document output. Instead, it provides low-level browser automation infrastructure via a Chrome DevTools Protocol bridge and timeout helpers. While such browser access could theoretically support scraping job sites, this chunk’s actual purpose is infrastructure for browser sessions, not the declared end-user job application assistant behavior. That is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about employment-related assistance workflows. The supplied code has an entirely different purpose: checking for newer CLI/extension versions, persisting cache data, fetching release metadata from external services, and emitting update notices on exit. These are unrelated capabilities and triggers, so the description does not accurately represent the code's behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for an end-user job-search/application/interview skill. The supplied code does not implement any of those functions. Instead, it defines metadata for a 'job-hunt-final-fix' workflow and orchestrates parallel agent tasks to fix defects in multiple markdown implementation plans, then performs a final cross-plan consistency confirmation. Its inputs and actions are entirely software-engineering focused: repo file paths, plan markdowns, specs, re-audit files, test expectations, code signatures, and git staging rules. This is a materially different primary purpose, not merely supporting infrastructure for the declared skill behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for an end-user employment-assistance skill with four interactive modes (discover, assess, apply, interview). The supplied code does not implement those user-facing functions. Instead, it is an internal maintenance/orchestration script for fixing and re-auditing plan documents in a local repository. It defines repo paths, detailed reconciliation rules, agent instructions for editing markdown plans, re-running extracted tests, generating a fifth implementation plan, and producing a final cross-plan consistency report. This is a materially different primary purpose and includes undeclared capabilities such as repository document editing, audit automation, and local filesystem workflow coordination. Therefore the description does not accurately represent the code's behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for an end-user job application and interview assistant. The supplied code does nothing related to job search, candidate assessment, resume/CV tailoring, cover letters, or interview rehearsal. Instead, it is an internal evaluation-reporting utility for aggregating experiment results from disk, rendering markdown summaries, and modifying benchmark output files. This is a materially different primary purpose and includes undeclared capabilities around local file I/O, benchmark patching, and command-line eval processing. Therefore the description does not accurately represent the code's behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code does not implement any job-finding, resume tailoring, cover-letter writing, application assessment, or interview rehearsal functionality. Instead, it is a CLI script for an eval pipeline: it reads grading outputs from baseline runs, inspects discriminating assertions, and reports whether guards were exercised or are non-discriminating. This is a materially different primary purpose and an unrelated capability set compared with the declared job-assistance description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This is a strong description-behavior mismatch. The declared purpose describes an end-user skill that helps with job discovery, application drafting, fit assessment, and interview practice. The supplied code does none of that directly. Instead, it is clearly a test/evaluation module ('evals/checkers.py') containing dozens of checker functions registered via decorators, each returning pass/fail/not-exercised judgments with evidence. Its primary purpose is to audit whether another skill/run behaved correctly according to policy and scenario expectations. While the checker categories mirror the declared product areas (discover/assess/apply/interview), that is only because it is grading those modes, not implementing them for the user. It also accesses internal harness resources and artifacts (journal receipts, raw captures, fixture convention files, stderr, workspace files) that are not part of the declared end-user assistant behavior. Therefore the code chunk's actual function is materially different from the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code is not related to job search, application drafting, resume tailoring, or interview practice. Its primary purpose is to grade evaluation runs in a testing harness by loading assertions, running checkers, preserving human-reviewed rows in some cases, and writing structured grading results. This is a materially different function from the declared job-assistance description, and it uses filesystem-based evaluation resources rather than user career-input resources. Therefore the description does not accurately represent the code's actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for an end-user job search/application/interview assistant. The supplied code does not implement any job-related functionality such as searching jobs, assessing postings, generating resumes or cover letters, or mock interviewing. Instead, it is a repository-internal developer tool that lints an assertions YAML file for evaluation quality and structural correctness. This is a materially different primary purpose and an undeclared capability set unrelated to the described skill. Therefore the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for a career assistance skill focused on job discovery, application preparation, and interview practice. The supplied code does none of that. Instead, it is an internal evaluation utility that audits grading.json files for missing or insufficient evidence and mismatched summaries. This is a materially different primary purpose and introduces undeclared filesystem-based linting capabilities unrelated to the job-assistance description. Therefore this is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for an end-user job-search/application/interview skill. The supplied code does not implement any user-facing job-hunting functionality such as finding jobs, assessing fit, tailoring CVs, generating cover letters, or conducting interview practice. Instead, it is infrastructure code for an evaluation system: it reads artifacts from run directories, prevents path escapes, parses YAML/JSON/journals, and iterates over stored eval runs. This is a materially different primary purpose and introduces undeclared filesystem/evaluation-harness capabilities unrelated to the declared skill behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code does not implement user-facing job discovery, job assessment, resume/CV tailoring, cover-letter generation, application review, or interview practice. Instead, it defines constants and schema-related structures for an internal evaluation framework that compares a skill against baselines. Although it includes mode names overlapping with the declared description ('discover', 'assess', 'apply', 'interview'), these are only enum-like schema values for eval records, not functionality to help users with jobs. This is a materially different primary purpose, so the description does not accurately represent the code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about end-user job search and application support workflows. The supplied code does not implement any job-finding, job-fit assessment, resume/CV generation, cover-letter writing, or interview rehearsal behavior. Instead, it performs low-level infrastructure checks for browser search/crawl accounting: validating navigation steps, enforcing row/page budgets, checking DOM extraction contracts, reading workspace files (brief.yaml and raw JSON snapshots), inspecting journals, and aggregating search usage. This is a materially different primary purpose and introduces undeclared capabilities around browser/session accounting and local workspace file validation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a user-facing career assistant that helps search for jobs, assess fit, create/tailor application materials, and rehearse interviews. The supplied code does something materially different: it is an internal compliance/QA gate for an 'apply' workflow. It inspects a workspace, validates journal receipts and file hashes, checks whether required upstream gates ran, verifies round verdict artifacts, enforces stop classifications, and exits with status codes controlling whether a package may be delivered. These are not merely implementation details of document generation; they are substantial internal auditing and gating capabilities absent from the description. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is of an end-user career assistant skill. The supplied code chunk instead implements a backend validation script for assess-mode outputs in a larger system. Its primary purpose is to audit generated assessment artifacts for policy/spec compliance and pipeline integrity, not to search jobs, assess fit directly for a user, generate resumes/cover letters, or run interview practice. While some checks align indirectly with the declared policy constraints (for example, no prediction language), the overall behavior is materially different: it is CI/runtime gatekeeping over files and receipts, with pass/fail journal output. That is a substantial description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about end-user job-hunting assistance: finding jobs, evaluating postings, creating resumes/cover letters, and interview practice. The supplied code does none of that. Its sole purpose is to lint 'market-conventions' YAML tables used elsewhere in the skill/repo. It checks required fields, IDs, HTTPS URLs, dates, expired reviews, protected-trait mentions, English/Chinese text ratios, modal asymmetry, and unverified-note overlap, then returns pass/fail/could-not-run outcomes and optionally writes a receipt. This is a materially different primary purpose and an undeclared capability unrelated to the described job-assistant behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for an end-user job assistance skill covering job discovery, fit assessment, application drafting, and interview rehearsal. The supplied code does none of that. Its primary purpose is internal QA/gating of generated assessment files: resolving or dropping evidence references, cleaning Markdown, handling workspace file errors, and logging receipts. This is a materially different purpose and introduces undeclared file-processing and journaling capabilities unrelated to the described job-coaching functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for a user-facing job search and application support skill with four modes (discover, assess, apply, interview). The supplied code does none of that. Its sole function is to enforce a layout-review process for CV/report artifacts in a workspace: it inspects cv.docx/cv.pdf/report.pdf, loads and validates layout-review YAML files, checks timestamps and reviewer fields, fingerprints files with SHA-256, verifies page counts and preview coverage, compares rendered outputs, and emits failure receipts. This is a materially different primary purpose and adds undeclared capabilities around local artifact validation and document layout compliance. Therefore the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad end-user job-coaching/application skill with modes for discovery, assessment, application, and interview practice. The supplied code chunk is instead a backend validation gate focused narrowly on checking a generated cover/motivation letter and posting metadata in workspace files. It enforces specific structural and textual constraints, compares artifacts, emits findings/notices, and records audit receipts. While this is tangentially related to the 'apply' mode and cover-letter support, the code’s actual behavior is a specialized QA/compliance checker over YAML inputs, including prose/AI-tell detection and renderer-specific formatting checks, which is a materially different primary purpose from the declared general job-assistance skill. Therefore this is a description/behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code does not implement any job-search, application, resume, cover-letter, or interview functionality. Its primary purpose is operational/audit enforcement: it reads a workspace journal, parses recorded command lines, checks command access levels using metadata, flags write commands or unknown access, validates capture records, and appends a receipt with pass/fail status. This is materially different from the declared end-user job-assistance purpose and introduces undeclared capabilities related to workspace auditing and file/journal handling.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for an end-user job-assistance skill, but the supplied code is an internal operational wrapper around OpenCLI adapter calls. Its primary function is error/result classification for site reads, including detecting authentication issues, anti-bot/rate-limit signals, malformed output, and incomplete content, then journaling the result. It does not implement resume tailoring, cover-letter writing, interview practice, job-fit assessment, or general job discovery logic. While job-site names appear in the code, they are only used in adapter-specific recovery/classification rules, not to provide the described user-facing job application features. This is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents an end-user job-application assistant focused on finding jobs, judging fit, tailoring resumes/cover letters, and practicing interviews. The supplied code does not implement those functions. Instead, it is a pipeline gate for quality assurance of already-generated application documents. Its main behaviors are counting pages in PDFs, extracting/validating PDF text, checking whether names and employer names survived rendering, computing allowed page limits from profile data and market rules, converting DOCX to PDF via LibreOffice for independent measurement, and recording findings/receipts. While this could support an application-building workflow, it is a narrow internal validation tool rather than the described skill itself. That is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code does not implement user-facing job search, application drafting, CV tailoring generation, cover-letter writing, interview rehearsal, or document output. Instead, it performs a narrow compliance check: it loads a tailored profile from disk, inspects protected personal data fields, evaluates whether the target market maps to a CV-convention cluster, fails specifically for Cluster-1 targets carrying protected data, and records a receipt. This is materially different from the declared primary purpose. While such a check could be a supporting internal safeguard within a resume-tailoring system, this code chunk itself is an auditing/enforcement component with file I/O and policy validation behavior not represented in the description.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.obfuscated_code

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/browser_session.mjs:215

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: evals/lint_assertions.py:211

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/tests/opencli-51job-dom.test.cjs:19

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/tests/opencli-dom.test.cjs:21

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: scripts/tests/test_cross_format_parity.py:192

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: scripts/tests/test_render_artifact_integrity.py:44

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: scripts/tests/test_render_cv.py:17