ClawHub
Back to skill

Security audit

Openjobs Ai Talent Search

Security checks across malware telemetry and agentic risk

Overview

The skill appears to perform its stated OpenJobs AI scholar-search function, but its setup instructions can expose a live API key.

Review before installing. Configure MIRA_KEY through a secure environment or secret manager, avoid pasting the key into chat or shared terminals, and do not let the agent print it with echo. Use the skill only for searches you are comfortable sending to OpenJobs AI.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
The skill instructs users to provide a raw API key and then set it via `export` in the shell, which normalizes direct handling of credentials in an interactive session. This can expose the key through shell history, terminal logs, shared sessions, or downstream tooling, creating unnecessary credential-handling risk beyond the search workflow itself.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
Telling users to run `export MIRA_KEY="..."` without warning about shell history, session persistence, screen recording, or multi-user host exposure is unsafe credential guidance. Even if common in developer docs, embedding this into agent skill instructions increases the chance that sensitive tokens will be mishandled or retained in insecure contexts.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.