ClawHub
Back to skill

Security audit

job-poster

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to post job listings, but it does not clearly say where it posts, what data it sends, or how users approve a posting before it goes live.

Review before installing. Only use this if you know which job-posting service JOB_API_KEY belongs to, can inspect the missing script, and can require a preview plus explicit approval before any job listing is published.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill's activation guidance is broad enough that an agent could invoke it for loosely related 'automation' or generic HR tasks without clear user intent to post a job. That increases the chance of unintended external actions, especially because job posting can publish data to third-party systems and create real-world operational effects.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The documentation indicates use of a JOB_API_KEY but does not warn that the skill likely sends job listing content to an external service. This can lead users or orchestrating agents to transmit sensitive hiring information, internal role details, or personal data without adequate notice, review, or approval.

Static analysis

No suspicious patterns detected.