Security audit

Jobclaw Recruit

Security checks across malware telemetry and agentic risk

Overview

This recruiter skill is mostly purpose-aligned, but it exposes account tokens in normal output and can send recruiting data to arbitrary API endpoints.

Review before installing. Use only with a trusted JobClaw endpoint, do not pass a custom apiUrl unless you trust that server, and treat any printed token like a password. Be aware the skill can publish, update, and deactivate job postings, cache recruiter credentials locally, and bring candidate resume/profile data into the conversation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill invokes local scripts that read/write local state and communicate with an external API, but it declares no permissions or user-facing disclosure of those capabilities. This creates a transparency and consent problem: users and the platform may not realize the skill can persist tokens/job IDs locally and transmit potentially sensitive recruiter and candidate data off-box.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description frames the skill mainly as publishing jobs, but the documented behavior also updates and deactivates jobs, retrieves profile/job data, aggregates candidate matches, and may expose authentication tokens in script output. That mismatch can cause unsafe invocation and insufficient user consent for destructive actions and access to broader recruiter/candidate data than the user expects.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger phrases are broad enough to overlap with ordinary conversation about hiring or recruiting, increasing the chance the skill activates when a user did not intend to publish, modify, or inspect external job-system data. In a skill capable of network actions and state changes, overbroad invocation materially raises the risk of unintended data transmission or unintended destructive operations.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs sending job, company, recruiter, and matched candidate information to an external API but does not prominently warn users that their data leaves the assistant environment. Because candidate resumes and hiring data can contain personal and commercially sensitive information, the lack of explicit notice and consent increases privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code persists a bearer authentication token to a local file in the script directory with no explicit permission hardening, encryption, or user disclosure. If the file is readable by other local users, included in backups, or accidentally packaged/shared, an attacker could reuse the token to act as the recruiter account against the remote API.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The publish path adds the recruiter's authentication token into the result object, and the main routine prints that object to stdout. This can leak bearer credentials to logs, calling agents, users, or downstream tools, enabling unauthorized API access and account misuse.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The update operation returns the current auth token and the CLI prints it, exposing credentials during a routine modification workflow. Any party with access to command output or logs could reuse the token to alter job postings or access other recruiter-authorized API endpoints.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The delete path similarly appends an auth token to the response before printing, turning a destructive action into a credential disclosure event. Because this skill manages recruiter operations, leaked tokens could permit unauthorized deletions, updates, or broader account actions depending on API scope.

Missing User Warnings

High

Confidence: 100% confidence
Finding: The candidate match listing function exposes the auth token alongside potentially sensitive candidate-match data, and the CLI prints both to stdout. In this recruiter context, that increases risk because the output may contain both access credentials and recruiting-related data that could be harvested from logs or agent transcripts.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.