Security audit

Remote Job Hunter

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real job-search helper, but it can submit applications and personal resume data with weak opt-out confirmation and conflicting privacy disclosures.

Install only if you are comfortable with a skill that can read your resume/profile, contact job sites, generate tailored files, and submit applications externally. Keep auto-apply disabled or use dry runs until the workflow requires explicit approval for each job, validates destination domains, removes generic auto-submit, and accurately discloses WhatsApp, SMTP, LinkedIn, and data-retention behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: src/apply.py:448
Finding: Untrusted Job Listings Can Exfiltrate Personal Data and Resume Files to Arbitrary Destinations
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/confirm.py:50
Finding: Automatic Applications Execute Without Affirmative Approval or Enforcement of the Confirmation Window
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: src/report.py:1
Finding: Remote Job Metadata Can Inject Instructions into Agent-Consumed Reports
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/tailor.py:424
Finding: Unescaped Remote Listing Values Are Injected into Generated DOCX XML
Content: View full analysis
{tailor_note} ''' # Insert after opening tag doc_xml = doc_xml.replace('', f'{note_xml}', 1) # Write back to docx with zipfile.ZipFile(original, 'r') as zin: with zipfile.ZipFile(output, 'w', zipfile.ZIP_DEFLATED) as zout: for item in zin.infolist(): if item.filename == 'word/document.xml': zout.writestr(item, doc_xml.encode('utf-8')) else: zout.writestr(item, zin.read(item.filename)) ``` ### Technical Analysis The job title and company are obtained from external listing data and inserted directly into an XML string. XML metacharacters such as `&`, `<`, and `>` are not escaped. A crafted value can terminate the `` node, add new XML elements, or make `word/document.xml` malformed. The affected XML is packed into a DOCX file and then used as the resume for automatic upload. This allows an external listing to influence the structure of a document derived from the user's original resume. ### Attack Path 1. An attacker creates a listing with XML metacharacters or crafted WordprocessingML in the title or company field. 2. The listing reaches the scoring and pending-application workflow. 3. Resume tailoring ...[truncated 702 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Open-Ended Dependency Constraints Make Builds Non-Reproducible
Content: View full analysis
=1.23.0 playwright>=1.40.0 ``` ### Technical Analysis Both dependencies use lower-bound-only constraints. An installation can therefore resolve to any future version, including releases that were not reviewed with this Skill. No lockfile or package hashes are supplied. Playwright is particularly security-sensitive because it controls browser execution, network navigation, and file uploads. PyMuPDF parses complex, potentially hostile document formats. Uncontrolled upgrades in either dependency can change security behavior, introduce vulnerabilities, or make installations non-reproducible. The audit did not identify a specific malicious package, typosquatted name, or known compromised release. The finding concerns unsafe dependency management rather than proof that the currently resolved packages are malicious. ### Attack Path 1. A user installs the project at a later date or in a different environment. 2. The package resolver selects newer versions satisfying the open-ended constraints. 3. The selected versions differ from those originally tested and audited. 4. Vulnerable, compromised, or incompatible dependency code executes during installation or runtime. 5. The dependency receives the privileges of the process, including access to local resume files and browser-driven network operations. ### Impact Assessment A compromised dependency would execute with the same operating-system permissions as the user running the Skill and could access profile files, resumes, generated documents, browser activity, and network resources. A merely incompatible release could cause parsing failures, browser automation errors, or altered security behavior. Exploitation depends on a malicious or vulnerable dependency release being selected. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (35)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This mismatch indicates the skill may perform materially different actions than the user would infer from the description, including undeclared outbound submissions, browser automation, and local persistence. In security terms, deceptive or incomplete capability disclosure undermines informed consent and can enable unauthorized exfiltration of resumes, credentials, or application data to third parties.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This mismatch indicates the skill may perform materially different actions than the user would infer from the description, including undeclared outbound submissions, browser automation, and local persistence. In security terms, deceptive or incomplete capability disclosure undermines informed consent and can enable unauthorized exfiltration of resumes, credentials, or application data to third parties.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This mismatch indicates the skill may perform materially different actions than the user would infer from the description, including undeclared outbound submissions, browser automation, and local persistence. In security terms, deceptive or incomplete capability disclosure undermines informed consent and can enable unauthorized exfiltration of resumes, credentials, or application data to third parties.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This mismatch indicates the skill may perform materially different actions than the user would infer from the description, including undeclared outbound submissions, browser automation, and local persistence. In security terms, deceptive or incomplete capability disclosure undermines informed consent and can enable unauthorized exfiltration of resumes, credentials, or application data to third parties.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This mismatch indicates the skill may perform materially different actions than the user would infer from the description, including undeclared outbound submissions, browser automation, and local persistence. In security terms, deceptive or incomplete capability disclosure undermines informed consent and can enable unauthorized exfiltration of resumes, credentials, or application data to third parties.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This mismatch indicates the skill may perform materially different actions than the user would infer from the description, including undeclared outbound submissions, browser automation, and local persistence. In security terms, deceptive or incomplete capability disclosure undermines informed consent and can enable unauthorized exfiltration of resumes, credentials, or application data to third parties.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This mismatch indicates the skill may perform materially different actions than the user would infer from the description, including undeclared outbound submissions, browser automation, and local persistence. In security terms, deceptive or incomplete capability disclosure undermines informed consent and can enable unauthorized exfiltration of resumes, credentials, or application data to third parties.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill advertises automated job applications and tailored resume submission to third-party platforms but does not clearly warn that it may transmit personal data externally. Because resumes often contain sensitive personal, employment, and contact information, omission of this warning materially increases the risk of unintended disclosure and unauthorized actions on the user's behalf.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The docstring and surrounding comments describe a resume-tailoring write path that unpacks the original DOCX, replaces text content, and repacks it while preserving formatting. In practice, the code builds tailored_text but never uses it, and only inserts a [TAILORED FOR: ...] note into document.xml, leaving the original resume content otherwise unchanged.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description at L003 tells users to use the skill to 'apply to jobs automatically,' implying current support, while L022 explicitly says the auto-apply engine is 'coming in v1.1.0 (not in current release).' This is a direct intent/documentation inconsistency about a core capability.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger text is overly broad and includes common phrases like 'find me remote jobs' and 'run my daily job search,' increasing the chance the skill is invoked in contexts where the user did not intend this specific automation. Because the skill processes resumes, performs external job-board queries, and may lead to outbound messaging, overbroad activation expands privacy and consent risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README advertises sending top matches via WhatsApp but does not clearly warn that resume-derived job search information will be transmitted to an external messaging platform. This can expose sensitive employment interests, qualifications, and preferences to third-party services without sufficiently informed user consent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The install command uses npx clawhub without pinning an exact package version, which can cause users to execute whatever version is currently published at install time. This creates a supply-chain risk: a compromised or malicious updated package could run arbitrary code on the user's system during installation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The daily automation instructions tell the agent to read the report and send a WhatsApp message, but omit any privacy warning or consent checkpoint before external delivery. In the context of a job-hunting skill that handles resume and skill-gap information, this omission makes accidental external disclosure more likely.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README security section claims that all data is written locally and nothing is sent externally, yet other sections instruct the agent to send job summaries over WhatsApp. This contradictory security claim can mislead users into sharing resume-derived or job-search data externally without informed consent, which is a privacy and trust violation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The manifest declares an automation-heavy skill but provides no explicit tool scope such as allowed-tools or permissions. For a skill that is described as reading resumes, writing tailored application artifacts, and interacting with remote job platforms, the absence of declared boundaries increases the chance of over-broad file and network access and prevents meaningful user review of what the skill may do.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The description uses broad automation language like daily searching, scoring, identifying gaps, and auto-applying without defining triggers, limits, approval points, or target boundaries. In a job-application context, such ambiguity is risky because it could cause unattended browsing, submissions, or data sharing with external services using personal resume information.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The profile uses very broad matching phrases and title keywords such as "llm", "ai ", "ml ", and "data scientist", which can over-match unrelated postings and trigger the wrong automation path. In this skill, that risk is amplified because matches are later used for resume tailoring and auto-application, so false positives can lead to unintended applications and disclosure of personal resume data to irrelevant employers.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The profile uses very broad phrases and title keywords such as "qa", "quality", and "test" without additional activation constraints, which can cause the agent to match unrelated listings or trigger on generic text. In this skill's context, that is security-relevant because the system auto-applies to jobs, so overbroad matching can lead to unintended applications, poor targeting, and unsafe automation actions against third-party sites.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The LinkedIn Easy Apply flow blindly checks radio buttons rather than deriving answers from verified profile data or requiring user input. On job applications, these radios commonly encode eligibility, sponsorship, relocation, security-clearance, or legal-attestation questions, so generic answers can cause false representations to third parties and submit materially inaccurate personal information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code path clicks the final LinkedIn submit button without an in-flow confirmation step at the moment sensitive personal data is transmitted. In the context of an auto-apply skill, that increases the risk of unintended submissions, especially because prior steps may have filled or guessed answers inaccurately.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The Greenhouse flow submits completed forms directly to a remote ATS after auto-filling personal data and attachments. Without a visible confirmation or review checkpoint in this path, the user may unknowingly disclose resume contents, contact details, and generated cover-letter text to unintended recipients or inaccurate postings.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The Lever handler performs remote submission immediately once a submit button is found, with no final user review. Given that the skill is designed to mass-apply across external job sites, this behavior can propagate accidental or incorrect disclosures at scale.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The Workday flow navigates multiple application steps and then submits personal data without an explicit confirmation gate. Because Workday forms often include legal declarations and profile data, silent submission raises the likelihood of unintended disclosures and inaccurate attestations being sent externally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The generic form path auto-fills arbitrary external pages and submits as soon as a matching submit control is found, with no domain-specific validation or final confirmation. In a browser automation context, a malicious or unexpected page could collect sensitive resume and contact data or trigger unintended actions because the code treats unknown sites as safe-to-submit by default.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.