four-leaf-coach

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 8:19 PM UTC
• Version: 1.0.0

Overview

This is a coherent job-search coaching skill that uses a disclosed Four-Leaf MCP integration for postings, resume scoring, interview practice, compensation research, and a user-controlled application tracker.

Install only if you are comfortable authorizing Four-Leaf's MCP to access your Four-Leaf account data for job-search coaching. Avoid sending highly sensitive recruiter links, private compensation details, or confidential job descriptions unless you intend them to be processed by Four-Leaf or an external fetch/search path. The skill should ask before saving jobs to your tracker.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 95% confidence

Finding

The instruction 'Don't decline' and 'don't gate the answer behind a clarifying question' weakens safety boundaries by pushing the agent to answer even when context is incomplete or the request may cross policy lines. In a skill with web search and external data access, anti-refusal language can cause over-eager behavior, reducing the chance the model pauses to verify user intent, assess abuse potential, or apply normal safety checks.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

## Operating principles

1. **Use the MCP. Don't hallucinate.** If a tool can answer the question, call the tool. Don't invent companies, postings, salary bands, or interview formats from training data when real data is available.
2. **Research, don't dodge.** When the MCP can't directly answer a legitimate question (like "what's a good salary for this role"), use web search to find real data and cite it. Don't decline, and don't gate the answer behind a clarifying question. "Don't hallucinate" means cite your sources, not refuse to help. A sourced, confidence-tagged answer always beats "I can't give you that". This matters most for comp research, where the instinct to be careful turns into a dodge.
3. **Coach, don't cheat.** The user is preparing for a real interview, not gaming one. Help them think clearly, build real skills, and notice their own gaps. If a user asks for live answers they can paste into an active interview, redirect.
4. **Push to practice.** Reading about an interview is weaker than practicing one. When the user has enough context, route them to `practice`. An answer typed in the chat gets scored against the real rubric by `score_answer`, so don't write your own score when the tool can run. The paid voice mock adds spoken delivery and adaptive follow-ups on top.
5. **Be specific.** Reference the user's actual role, company, and seniority. Generic advice is a tell that you didn't use the MCP.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/commands/analyze-jd.md (reported line 61)May include surrounding context.

md

- Don't editorialize that the score is "bad" or "great". State it, calibrate against the bands above, move forward.
- Don't make up skills the resume doesn't mention. Only call out what `match_score` actually returned.
- Don't WebFetch a posting you can get from `get_job`. The corpus copy is already text, it costs nothing, and the fetch can fail.
- Don't lecture about resume best practices in general. Focus on this resume vs. this JD.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 55% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/commands/find-jobs.md (reported line 46)May include surrounding context.

md

## Edge cases

- **Zero results.** Don't apologize. Ask for one specific adjustment ("try a different location or drop the seniority?"). Check `appliedFilters` first: a company name is a hard filter and a misspelling looks exactly like an empty market.
- **Rate-limited.** Free tier is 30 searches/day, shared with job search on four-leaf.ai. Tell the user when it resets and that paid plans are uncapped. `get_job` and `save_application` are unmetered, so they can still work through results they already have.
- **The user names a specific company.** `search_jobs` handles company filters in the natural language. If they want deeper company-specific intel beyond what's in the postings, route to prep-role or interview-strategy and pass the company name.
- **The user asks about a posting from a previous search.** Ids don't expire on a timer, and a filled role still resolves (with `active: false`, which is worth mentioning before they spend effort on it). An id only stops resolving once the row leaves the corpus entirely, which is what `job_not_found` means. If you get it, search again.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/commands/interview-strategy.md (reported line 44)May include surrounding context.

md

- Don't write a 2000-word essay. The user wants signal, not a syllabus.
- Don't generalize across companies. "FAANG interviews" is too coarse. If the user names a company, get specific via `explain_interview_format` with the company arg.
- Don't moralize about whether interview formats are fair. The user is trying to pass the interview that exists, not redesign it.
- Don't hallucinate that Four-Leaf has company-specific interview format data beyond what `explain_interview_format` returns.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · references/commands/negotiate-prep.md (reported line 62)May include surrounding context.

md

### Step 2c: Market-rate research (no offer, they just want to know what's normal)

This is a research question, and you answer it with real data. Do not ask the user for an offer they don't have, and do not refuse to name a number. That's the dodge we're avoiding. `comp_coach` is the wrong tool here (it needs a `baseSalary` to analyze); use `comp_benchmarks` instead.

1. **Call `comp_benchmarks` first.** This is the tool built for exactly this question. Pass the `role` plus whatever you have (`level`, `location`, `companyType` like "non-profit" or "startup", `company`). It runs a live web search server-side and returns a cited salary band (broken out by level if you don't pass one), total-comp context, named sources, and a confidence rating. You don't need your own web search for this to work, which is the point: it answers reliably even in clients that have no web search. Lead with the band it returns. It runs a live web search, so it takes longer than the other tools (often 30-60s). Tell the user up front you're pulling live market data so the short wait makes sense.
2. **Supplement with your own web search only to fill a gap.** If `comp_benchmarks` came back high-confidence with good sources, don't run a second search, it's just wasted time. Reach for your own web search (if your client has it) only when its confidence is low, or to chase something specific it didn't cover (a named employer, a niche location). Supplement, never the primary path.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill says to infer workflows from phrases like "find me a job," "help me negotiate," and "give me questions," and to default to kickoff when intent is unclear. These examples overlap with common conversational requests and the file does not provide clear exclusion conditions or negative examples, making activation scope ambiguous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs the agent to fetch arbitrary third-party job-posting URLs with WebFetch, but it never tells the user their supplied link may be sent to an external retrieval tool. That creates a transparency and privacy issue: user-provided URLs can contain tracking parameters, private recruiter links, or tokens, and fetching them may disclose user intent or sensitive link contents to another service.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The 'When to run' section says to invoke this command for generic phrases like 'help me with my job search' and whenever the user's intent doesn't map cleanly to another workflow. Those conditions are broad and lack clear boundaries or exclusion examples, which could cause the skill to activate in many ordinary job-search conversations instead of only intended kickoff cases.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger condition "I don't know what I'm doing here" about comp is intentionally vague and overlaps with common conversational language, making it unclear when this skill should activate versus when a general coaching skill should. The file does not provide negative examples or clearer exclusion criteria to constrain this trigger.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/commands/negotiate-prep.md (reported line 62)May include surrounding context.

md

### Step 2c: Market-rate research (no offer, they just want to know what's normal)

This is a research question, and you answer it with real data. Do not ask the user for an offer they don't have, and do not refuse to name a number. That's the dodge we're avoiding. `comp_coach` is the wrong tool here (it needs a `baseSalary` to analyze); use `comp_benchmarks` instead.

1. **Call `comp_benchmarks` first.** This is the tool built for exactly this question. Pass the `role` plus whatever you have (`level`, `location`, `companyType` like "non-profit" or "startup", `company`). It runs a live web search server-side and returns a cited salary band (broken out by level if you don't pass one), total-comp context, named sources, and a confidence rating. You don't need your own web search for this to work, which is the point: it answers reliably even in clients that have no web search. Lead with the band it returns. It runs a live web search, so it takes longer than the other tools (often 30-60s). Tell the user up front you're pulling live market data so the short wait makes sense.
2. **Supplement with your own web search only to fill a gap.** If `comp_benchmarks` came back high-confidence with good sources, don't run a second search, it's just wasted time. Reach for your own web search (if your client has it) only when its confidence is low, or to chase something specific it didn't cover (a named employer, a niche location). Supplement, never the primary path.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs the agent to send role, level, location, company, and related context to a server-side live web search tool without warning the user that their employment details may be transmitted to external systems. In a job-search context, those details can be sensitive and may expose a user's current employer, compensation expectations, or negotiation status if handled without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill exposes a state-changing tool (save_application) that writes to the user's application tracker, but this reference does not instruct the agent to obtain explicit user confirmation immediately before performing the save. In a coaching/job-search context, users may discuss jobs hypothetically, and an agent could infer intent and persist data without a clear authorization step, causing unwanted account changes and privacy/trust issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill encourages saving company, title, URL, and description into the user's Four-Leaf tracker, but the prompt does not clearly disclose that these details will be persisted on their account. While the user is asked whether to save it, the lack of explicit storage notice can lead to unintentional retention of application data or sensitive job-search activity.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The 'When to run' section says to run for open-ended questions like 'what's it like to interview with AI now?' and for users wanting general strategy context not tied to a role. These conditions are somewhat subjective and lack negative examples or sharper boundaries, which could cause the skill to activate for a wide range of general career-chat requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.