Security audit

Jobautopilot Bundle

Security checks for vulnerabilities and agentic risk

Overview

This job-application automation bundle is mostly transparent, but it installs mutable external skills and has an under-scoped setup script that can overwrite an OpenClaw config path for special username input.

Review the three dependent jobautopilot skills before use, avoid running install.sh unless you trust the publisher and current registry packages, and do not use '.' or '..' as the setup username. Treat the generated config as sensitive because it stores personal, resume, and EEOC defaults that later automation may put into job applications.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: setup.sh:111
Finding: Username Validation Allows Configuration File Overwrite Outside the Intended Directory
Content: View full analysis
"$CONFIG_DIR/config.sh" << EOF # jobautopilot skill bundle — user config # Generated by setup.sh on $(date +%Y-%m-%d) # Edit any value here; re-run setup.sh to regenerate from scratch. # This file is read-only by the agent. Nothing in it is sent to any network. export OPENCLAW_USER="${OPENCLAW_USER}" export OPENCLAW_PROFILE="apply" # browser profile used for submitting applications # Personal info export USER_FIRST_NAME="${USER_FIRST_NAME}" export USER_LAST_NAME="${USER_LAST_NAME}" export USER_EMAIL="${USER_EMAIL}" export USER_PHONE="${USER_PHONE}" export USER_LINKEDIN="${USER_LINKEDIN}" # File paths export RESUME_DIR="${RESUME_DIR}" export RESUME_OUTPUT_DIR="${RESUME_OUTPUT_DIR}" export RESUME_TEMPLATE="\$HOME/.openclaw/workspace/job_sub_agent/scripts/sample_placeholders.docx" export MD_TO_DOCX_SCRIPT="\$HOME/.openclaw/workspace/job_sub_agent/scripts/md_to_docx.py" export TRACKER_PATH="\$HOME/.openclaw/workspace/job_search/job_application_tracker.md" ex ...[truncated 3148 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: install.sh:13
Finding: Unpinned External Skills and Python Dependency Create Supply-Chain Risk
Content: View full analysis
/dev/null; then echo " ✅ $SKILL installed" elif openclaw skills update "$SKILL" 2>/dev/null; then echo " ✅ $SKILL updated" else echo " ⚠️ $SKILL failed — try manually: openclaw skills install $SKILL" fi done ``` The documentation also instructs users to install an unpinned Python package: ```markdown ## Requirements - OpenClaw >= 2026.2.0 - Browser tool enabled - `pip install python-docx` ``` ### Technical Analysis The audited bundle does not contain the implementation of `jobautopilot-search`, `jobautopilot-tailor`, or `jobautopilot-submitter`. Instead, it asks `openclaw` to resolve and install the current registry artifacts associated with those names. The fallback also invokes `openclaw skills update`, which can replace an existing installation with a newer mutable artifact. No version constraint, immutable digest, signature validation, or publisher identity verification is implemented by this script. Therefore, the code ultimately executed by the workflow can differ from the code reviewed in this audit. The same principle applies to the documented `pip install python-docx` command. Without a version and hash, package resolution depends on mutable repository state and the user's Python package index configuration. The scripts in this bundle do not themselves perform direct arbitrary remote-code execution. The risk arises when externally controlled components are installed and later loaded or executed as trusted workflow dependencies ...[truncated 1690 chars]
Remediation: View remediation
--hash=sha256: ``` Install them with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 6. Audit `jobautopilot-search`, `jobautopilot-tailor`, and `jobautopilot-submitter` independently before installation or execution. 7. Preserve package-manager error output or log it securely. Redirecting all standard error to `/dev/null` impedes investigation of signature, repository, or dependency-resolution failures. 8. Run external skills with least privilege and limit their filesystem, browser, and network access to the capabilities required for their documented tasks. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The bundle description understates behavior by framing the skill as a simple installer while the content indicates collection and local storage of sensitive personal and EEOC data, setup/configuration actions, and browser-profile persistence. This mismatch is dangerous because users may consent to installation without realizing the skill initializes a workflow that handles regulated and highly sensitive information.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises shell-backed behavior through referenced scripts but does not declare any explicit tool scope or allowed-tools boundary. That weakens least-privilege controls and makes it harder for a user or platform to understand what execution capabilities the bundle expects before installation.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 89% confidence
Finding: The skill explicitly relies on persistent browser profiles for job-search and job-application sessions. Even if created manually, persistent profiles can retain authentication state, cookies, autofill data, and browsing artifacts, increasing the risk of account misuse or privacy leakage if the environment or downstream automation is compromised.
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
md
- **No outbound network calls from scripts**: `install.sh` and `setup.sh` operate locally only. The only network operations are `openclaw skills install` (downloading these skills) and browser navigation you explicitly request. - **No password handling**: This skill does not read, store, or transmit any passwords. Login flows rely on your browser's own credential store. - **Browser profiles**: Setup instructs you to manually create two isolated profiles (`search`, `apply`) using `openclaw browser profile create`. No browser profiles are created automatically by any script. You can inspect or delete them at any time. - **Personal data**: Written only to `~/.openclaw/users/<you>/config.sh`. Setup automatically restricts this file to owner-only access (`chmod 600`). Read `setup.sh` in full before running to verify this. - **Helper scripts**: All scripts in `scripts/` are plain shell, Python, and JavaScript with no obfuscation, no encoded payloads, no remote fetches at runtime. - **EEOC fields**: Standard fields required by US job application forms (Equal Employment Opportunity Commission). Values are stored locally in your config and supplied only to forms you explicitly instruct the agent to fill. They are never logged or transmitted elsewhere.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
md
- **No outbound network calls from scripts**: `install.sh` and `setup.sh` operate locally only. The only network operations are `openclaw skills install` (downloading these skills) and browser navigation you explicitly request. - **No password handling**: This skill does not read, store, or transmit any passwords. Login flows rely on your browser's own credential store. - **Browser profiles**: Setup instructs you to manually create two isolated profiles (`search`, `apply`) using `openclaw browser profile create`. No browser profiles are created automatically by any script. You can inspect or delete them at any time. - **Personal data**: Written only to `~/.openclaw/users/<you>/config.sh`. Setup automatically restricts this file to owner-only access (`chmod 600`). Read `setup.sh` in full before running to verify this. - **Helper scripts**: All scripts in `scripts/` are plain shell, Python, and JavaScript with no obfuscation, no encoded payloads, no remote fetches at runtime. - **EEOC fields**: Standard fields required by US job application forms (Equal Employment Opportunity Commission). Values are stored locally in your config and supplied only to forms you explicitly instruct the agent to fill. They are never logged or transmitted elsewhere.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · setup.sh (reported line 186)May include surrounding context.
sh
- **No outbound network calls from scripts**: `install.sh` and `setup.sh` operate locally only. The only network operations are `openclaw skills install` (downloading these skills) and browser navigation you explicitly request. - **No password handling**: This skill does not read, store, or transmit any passwords. Login flows rely on your browser's own credential store. - **Browser profiles**: Setup instructs you to manually create two isolated profiles (`search`, `apply`) using `openclaw browser profile create`. No browser profiles are created automatically by any script. You can inspect or delete them at any time. - **Personal data**: Written only to `~/.openclaw/users/<you>/config.sh`. Setup automatically restricts this file to owner-only access (`chmod 600`). Read `setup.sh` in full before running to verify this. - **Helper scripts**: All scripts in `scripts/` are plain shell, Python, and JavaScript with no obfuscation, no encoded payloads, no remote fetches at runtime. - **EEOC fields**: Standard fields required by US job application forms (Equal Employment Opportunity Commission). Values are stored locally in your config and supplied only to forms you explicitly instruct the agent to fill. They are never logged or transmitted elsewhere.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · setup.sh (reported line 187)May include surrounding context.
sh
- **No outbound network calls from scripts**: `install.sh` and `setup.sh` operate locally only. The only network operations are `openclaw skills install` (downloading these skills) and browser navigation you explicitly request. - **No password handling**: This skill does not read, store, or transmit any passwords. Login flows rely on your browser's own credential store. - **Browser profiles**: Setup instructs you to manually create two isolated profiles (`search`, `apply`) using `openclaw browser profile create`. No browser profiles are created automatically by any script. You can inspect or delete them at any time. - **Personal data**: Written only to `~/.openclaw/users/<you>/config.sh`. Setup automatically restricts this file to owner-only access (`chmod 600`). Read `setup.sh` in full before running to verify this. - **Helper scripts**: All scripts in `scripts/` are plain shell, Python, and JavaScript with no obfuscation, no encoded payloads, no remote fetches at runtime. - **EEOC fields**: Standard fields required by US job application forms (Equal Employment Opportunity Commission). Values are stored locally in your config and supplied only to forms you explicitly instruct the agent to fill. They are never logged or transmitted elsewhere.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The comments state that no data is sent to any network endpoint and that the stored EEOC and personal data are local-only, yet the same file writes those values into a shared config and describes them as being supplied to job application forms by the agent. While this script itself does not send network traffic, the documentation is stronger than the actual operational intent conveyed elsewhere in the file and can mislead a user about how the collected data will be used.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The header describes the script as asking questions, writing config, creating folders, copying scripts, and creating browser profiles, but the generated config and quick-start content are specifically structured to enable searching job sites and submitting applications through other installed skills. This is a mild description/behavior mismatch because the bundle manifest frames the bundle as installing the full pipeline, while this file performs additional user profiling and operational initialization beyond a simple installer.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.