ClawHub
Back to skill

Security audit

Ai Jd Generator

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward AI job-description generator that uses a DeepSeek-compatible API, with the main caution that job details entered by the user are sent to that external service.

Before installing, confirm that using DeepSeek or the configured compatible endpoint is approved for your organization. Avoid entering confidential company plans, compensation details, or candidate/personnel data unless that provider and API key are authorized for that data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares access to an API key and implies outbound calls to DeepSeek, but it does not declare explicit permissions for network or sensitive environment access. This creates a transparency and governance gap: users and the platform may not realize that user-provided recruiting data can be transmitted externally, which can lead to unintended data exposure and weaker permission enforcement.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger conditions are broad enough to activate on many ordinary recruiting or career-related requests, increasing the chance the skill runs when the user did not intend to invoke it. Because the skill appears to use an external LLM service, overbroad activation can cause unnecessary disclosure of user prompts or business hiring details to a third party.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs users to configure a DeepSeek API key but does not clearly warn that job details and user inputs may be sent to an external API provider. In a recruiting context, prompts may contain confidential company plans, compensation ranges, locations, or candidate-related information, so lack of disclosure meaningfully increases privacy and compliance risk.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
User-supplied job details are sent to an external LLM API, but the script gives no explicit user-facing notice or consent step before transmitting potentially sensitive hiring information. In an HR context, prompts may include confidential role requirements, compensation bands, locations, or internal company details, so silent transmission increases data exposure risk.

External Transmission

Medium
Category
Data Exfiltration
Content
}

    try:
        resp = requests.post(url, headers=headers, json=data, timeout=180)
        if resp.status_code >= 400:
            print(f"API请求失败 (HTTP {resp.status_code}): {resp.text}", file=sys.stderr)
            sys.exit(1)
Confidence
92% confidence
Finding
requests.post(url, headers=headers, json=

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:117