ClawHub
Back to skill

Security audit

Job Watch

Security checks for vulnerabilities and agentic risk

Overview

The skill is a plausible job-search helper, but it under-discloses profile-derived data sent to job sites and allows broadly configurable web fetching.

Review before installing. This skill should only be used with trusted platform configuration, preferably limited to known public HTTPS job-board hosts. Assume role, keyword, and location search terms may be sent to job sites, and avoid putting sensitive personal details in the profile unless you are comfortable with derived searches using them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:44
Finding

Unrestricted Configurable Network Retrieval

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:44-47; examples/platforms.md:5-8; references/url-extraction-guide.md:14-18
Vulnerability Type: Server-Side Request Forgery through unvalidated configurable URLs
Risk Level: Medium

Relevant code snippets:

SKILL.md:44-47

markdown
1. **Load user profile** from `~/.openclaw/workspace/skills/job-watch/memory/profile.md`
2. **Load scoring rules** from `~/.openclaw/workspace/skills/job-watch/memory/scoring.md`
3. **Load platform list** from `~/.openclaw/workspace/skills/job-watch/memory/platforms.md`
4. **For each platform**, scrape jobs posted in the last 7 days (use browser tools or HTTP requests)

examples/platforms.md:5-8

markdown
Each platform must include:
- Name
- Search URL template (use {query} and {location} placeholders)
- Selector rules for job title, company, date, link (if needed by AI)

references/url-extraction-guide.md:14-18

markdown
### Implementation Notes:
When implementing the job watch skill:
1. Use `web_fetch` to get HTML content
2. Parse HTML to extract actual URLs using regex or HTML parsing
3. Never construct URLs based on job titles alone
4. Always include the report with verified, working URLs

Technical Analysis

The skill loads network targets from a locally configurable platforms.md file and directs the agent to retrieve those targets using browser, HTTP, or web_fetch tools. It does not require validation of URL schemes, destination hosts, resolved IP addresses, ports, or redirects.

Although SKILL.md documents an expected set of public job-board endpoints, the execution instructions do not enforce that list as an allowlist. If an attacker or another untrusted process can modify the platform configuration, the target can potentially be changed to a loopback, private-network, link-local, cloud metadata, or attacker-controlled address.

The actual reachability and data ex ...[truncated 1695 chars]

Remediation
View remediation

Remediation Suggestions

  1. Enforce an exact allowlist of approved HTTPS hostnames instead of accepting arbitrary platform URLs.
  2. Permit only https URLs and reject URLs containing user information, unexpected ports, fragments, or nonstandard schemes.
  3. Resolve each hostname before retrieval and reject loopback, private, link-local, multicast, reserved, and cloud metadata address ranges for both IPv4 and IPv6.
  4. Repeat destination validation after every redirect and prevent redirects to hosts outside the allowlist.
  5. Apply strict connection timeouts, response-size limits, content-type checks, and download limits.
  6. Keep the documented endpoint table and the enforced allowlist synchronized.
  7. Require explicit user confirmation before accessing any newly configured hostname.
  8. Ensure the fetch environment does not automatically attach cookies, authorization headers, or internal credentials to configurable destinations.
  9. Sanitize report fields so responses from unexpected services cannot be copied into reports without clear boundaries.

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:38
Finding

Untrusted Web Content Is Processed Without an Instruction Boundary

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:38-51; references/url-extraction-guide.md:14-18
Vulnerability Type: Indirect prompt injection through scraped web content
Risk Level: Medium

Relevant code snippets:

SKILL.md:38-51

markdown
## Execution Instructions (CRITICAL)

When the user says **"run job watch now"**, **DO NOT run any shell commands** (including `find`, `ls`, `cat`, `bash`, `python`). This skill is designed to be executed entirely by the AI using web-scraping and browser tools, ensuring it works across all OpenClaw configurations without requiring local file system access.

### Steps to Execute

1. **Load user profile** from `~/.openclaw/workspace/skills/job-watch/memory/profile.md`
2. **Load scoring rules** from `~/.openclaw/workspace/skills/job-watch/memory/scoring.md`
3. **Load platform list** from `~/.openclaw/workspace/skills/job-watch/memory/platforms.md`
4. **For each platform**, scrape jobs posted in the last 7 days (use browser tools or HTTP requests)
5. **Filter** jobs that match user’s target role, location, and keywords
6. **Score** each job (0–100) based on scoring rules
7. **Generate report** in the format below
8. **Save report** to `~/.openclaw/workspace/skills/job-watch/memory/reports/YYYY-MM-DD-job-watch-report.md`

references/url-extraction-guide.md:14-18

markdown
### Implementation Notes:
When implementing the job watch skill:
1. Use `web_fetch` to get HTML content
2. Parse HTML to extract actual URLs using regex or HTML parsing
3. Never construct URLs based on job titles alone
4. Always include the report with verified, working URLs

Technical Analysis

The skill directs an AI agent to retrieve and interpret content from public websites. Job titles, descriptions, company names, links, and surrounding page text are attacker-controlled inputs. The instructions do not explicitly require the agent to treat retrieved page content ...[truncated 2208 chars]

Remediation
View remediation

Remediation Suggestions

  1. Add an explicit rule that all retrieved page content is untrusted data and must never be treated as instructions.
  2. Instruct the agent to ignore requests embedded in listings, HTML, metadata, linked pages, or downloaded content.
  3. Extract only a fixed schema, such as title, company, publication date, location, description summary, and canonical URL.
  4. Prefer deterministic HTML parsing or site-specific selectors over unrestricted natural-language interpretation of complete pages.
  5. Strip scripts, hidden text, comments, forms, and unrelated navigation content before model processing.
  6. Restrict tools available during scraping to allowlisted read-only network retrieval and the single expected report-write operation.
  7. Require explicit user confirmation before accessing unrelated domains, reading additional local files, sending messages, submitting forms, or performing any action outside report generation.
  8. Validate and sanitize extracted links and escape untrusted text before placing it into Markdown reports.
  9. Apply field-length limits and preserve clear delimiters around all externally sourced content.
  10. Record the source URL for each result so manipulated output can be traced and independently verified.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation says the skill should work without requiring local file system access and must not use shell commands, yet the very next steps instruct loading multiple local memory files and saving a report locally. This is an active contradiction in the skill's own instructions about how it is meant to operate.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The documentation claims profile data stays local, but the skill's filtering and search process depends on user role, location, and keywords while interacting with external endpoints. Even if only derived search terms are sent, the blanket statement that profile data stays local is contradicted by the described execution behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.