Indeed Monitor

PassAudited by ClawScan on May 10, 2026.

Overview

This skill appears to scrape public Indeed job postings and optionally save leads locally; the main things to notice are its browser/CLI dependencies and persistent lead-list write.

This looks purpose-aligned for generating leads from Indeed. Before installing or running it, confirm the local OpenClaw/Chrome relay and scrapling helper are the ones you expect, consider using a dedicated browser profile, and review the lead file before using --save repeatedly.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running the skill can drive a local browser relay to visit Indeed and collect page snapshots.

Why it was flagged

The skill delegates navigation and page snapshots to the local OpenClaw browser CLI. This is expected for an Indeed monitoring scraper, but it is still browser automation that creates web traffic and reads page content.

Skill content
["openclaw", "browser", "navigate", "--url", url, "--profile", "chrome"]
Recommendation

Run it intentionally, verify the browser relay/profile being used, and review custom query/location inputs before use.

What this means

Actual behavior of the fallback path partly depends on a separate local scrapling installation.

Why it was flagged

The fallback scraper depends on a helper script outside this skill's manifest, while the registry metadata declares no install requirements. The dependency is purpose-aligned, but this review cannot verify that external helper.

Skill content
SCRAPLING_SCRIPT = "/Users/wlc-studio/StudioBrain/00_SYSTEM/skills/scrapling/scrape.py"
Recommendation

Verify the referenced scrapling helper before use, and declare/pin required local dependencies in the skill metadata or install documentation.

What this means

Indeed may see the browser state associated with the selected Chrome profile.

Why it was flagged

The browser workflow uses a named Chrome profile through the OpenClaw relay. The artifacts do not show credential extraction or forwarding, but using a real browser profile may carry session context to Indeed.

Skill content
"--profile", "chrome"
Recommendation

Use a dedicated browser profile for scraping if you do not want the skill to operate in your regular browser session.

What this means

Malformed or misleading job-posting text could persist in a local lead file and later be reused in business or agent workflows.

Why it was flagged

When --save is used, web-derived company names, titles, and locations are written directly into a persistent Markdown lead list. This is aligned with the skill's purpose, but the saved content is untrusted external text.

Skill content
with open(LEADS_FILE, "a") as f: ... f.write(f"| {lead['company']} | {lead['title']} | {lead['location']} | {signals} |\n")
Recommendation

Review saved leads, treat the lead file as untrusted external data, and consider escaping Markdown/table characters before persisting scraped content.