ClawHub
Back to skill

Security audit

Freelance Job Scraper

Security checks for vulnerabilities and agentic risk

Overview

The skill appears non-malicious but substantially overstates what its job scanner actually does.

Install only if you are comfortable with a rough HN-only prototype that may produce incomplete or empty results. Review the script before running it with an authenticated gh CLI, and avoid using --output with sensitive or important file paths.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill description materially overstates what the implementation does, including claiming to scan YC and remote job boards and to evaluate postings when the effective behavior is different. This mismatch is dangerous because users or higher-level agents may grant trust, permissions, or make decisions based on false assumptions about data sources, coverage, and autonomy, which can lead to unsafe automation and misleading outputs.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises executable usage (python3 scripts/scan_jobs.py) and prerequisites including gh CLI, but it declares no explicit tool scope or permissions boundaries. That makes the skill capable of invoking shell commands and writing files without a documented allowlist, increasing the chance of overbroad execution, unsafe file modification, or misuse in agent runtimes that rely on manifest-declared permissions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The top-level documentation explicitly states broader coverage than the actual implementation provides. The only scanning function present is scan_hn_jobs, and no code exists for YC jobs or remote board scraping, so the docstring overstates the skill's behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/scan_jobs.py (reported line 18)May include surrounding context.

python
KEYWORDS_PAY = ["$", "usd", "hour", "fixed", "budget", "pay"]

def gh(cmd):
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        return []
    try:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description promises multi-source monitoring across Hacker News, YC jobs board, and remote job aggregators. In practice, the implementation only builds a query for "who is hiring" and uses the GitHub CLI API to search issues, with no code paths for YC jobs or remote job sources.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.