Security audit

CareerClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly fits a job-search tool, but it needs Review because it can auto-install a global package, overstates its instruction priority, and under-discloses credential and network handling.

Install only if you are comfortable with a job-search tool reading your resume/profile, writing .careerclaw tracking files, contacting RemoteOK and Hacker News, and, for Pro, sending license validation to Gumroad and draft context to your configured LLM provider. Before routine use, require explicit approval for any global npm install, avoid running the debug license scripts with real keys, and treat generated outreach from public job listings as something to review before sending.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:65
Finding: Skill Rules Attempt to Override All Other Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/debug_license.ts:10
Finding: Debug Scripts Print the Complete Pro License Key
Content: View full analysis
0)}`); ``` ### Technical Analysis Both debugging scripts print the full value of `CAREERCLAW_PRO_KEY`. Because these scripts are documented npm debugging commands and load `.env`, the secret can be exposed through terminal scrollback, CI logs, support transcripts, screen sharing, redirected output, or centralized log collection. This behavior contradicts the project's stated credential-handling guarantee that the Pro key is never logged. A partial key is also printed later by `debug_license.ts`, but the complete-key logging above is the primary vulnerability. ### Attack Path 1. A user stores a valid Pro key in `.env` or the process environment. 2. The user runs `npm run debugging:license` or `npm run debugging:pro`. 3. The script loads the environment and prints the complete key. 4. Terminal output is retained, redirected, shared, or collected by CI/logging infrastructure. 5. An unauthorized party retrieves and reuses the exposed license key. ### Impact Assessment An attacker who obtains the output can acquire the complete CareerClaw Pro license credential and potentially use paid features without authorization. The flaw exposes this specific credential; no evidence shows ...[truncated 81 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/license.ts:96
Finding: Raw Pro License Key Is Sent to an Undisclosed Gumroad Endpoint
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:52
Finding: Skill Automatically Performs a Global npm Installation
Content: View full analysis
/dev/null || echo "")" if [ "$INSTALLED" != "$EXPECTED" ]; then npm install -g careerclaw-js@"$EXPECTED" fi ``` ### Technical Analysis The Skill instructs the agent to execute a global npm installation automatically whenever the installed version differs from the expected version. Pinning the version reduces accidental version drift but does not verify package integrity, provenance, registry selection, or signatures. A global installation changes the user's system-level npm environment and may execute package lifecycle scripts. This exceeds the minimum runtime behavior needed to fetch and rank jobs, particularly when it occurs without an explicit installation confirmation. ### Attack Path 1. The CLI is absent or reports a version other than `1.0.3`. 2. The Skill automatically runs `npm install -g careerclaw-js@"1.0.3"`. 3. npm resolves the package through the configured registry. 4. The downloaded package and any applicable lifecycle scripts execute with the privileges of the agent process. 5. A compromised registry account, package release, registry configuration, or dependency can affect the host globally. ### Impact Assessment The installation can modify global npm package state and place executables in global binary directories writable by the current account. If the installed package or dependency is compromised, code can execute with the agent process's user privileges. The repository itself contains no confirmed malicious npm dependency or `postinstall` hook; the risk arises from automatic, globally scoped supply-chain execution. ]]>
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: src/llm-enhance.ts:232
Finding: Untrusted Job Listing Fields Are Embedded Directly into LLM Instructions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (104)

Known Vulnerable Dependency: vitest==2.1.9 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

Category: Supply Chain
Confidence: 90% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: vitest==2.1.9 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

Category: Supply Chain
Confidence: 92% confidence
Finding: vitest 2.1.9 is reported as vulnerable to arbitrary file read and execution issues in specific testing/UI-related contexts. Because this is a devDependency, the risk is mainly during local development or CI when Vitest UI/server features are enabled, but compromise in those environments can still expose source code, secrets, or build agents.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the package includes outbound LLM request behavior and privacy-related test/exercise paths while the skill only lightly mentions optional API keys, users may not appreciate that resume-derived content could be sent to third-party model providers. Given the sensitivity of career data, incomplete disclosure raises privacy risk even if the behavior is feature-related rather than malicious.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==5.0.4 — 5 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-45149 (brace-expansion: Large numeric range defeats documented `max` DoS protection) +2 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-xml-builder==1.0.0 — 1 advisory(ies): CVE-2026-44665 (fast-xml-builder allows attribute values with unwanted quotes to bypass maliciou)

High

Category: Supply Chain
Confidence: 91% confidence
Finding: fast-xml-builder is a runtime dependency of fast-xml-parser, and the advisory indicates malformed attribute encoding can allow malicious content to bypass intended sanitization during XML generation. In a job-search skill that may transform or emit XML-like content from external feeds or user-controlled profile/job data, this could enable injection into downstream consumers or corrupted structured output.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-xml-parser==5.4.2 — 3 advisory(ies): CVE-2026-33036 (fast-xml-parser affected by numeric entity expansion bypassing all entity expans); CVE-2026-41650 (fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimi); CVE-2026-33349 (Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evalua)

High

Category: Supply Chain
Confidence: 95% confidence
Finding: fast-xml-parser is a direct runtime dependency, making its XML entity expansion and builder injection advisories relevant to the deployed skill. Since a career-search tool may ingest third-party job feeds, resumes, or syndication data in XML, maliciously crafted input could trigger denial of service or content injection during parse/build operations.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/tests/cli.test.ts:32