Get Hired PRO - Get the Job of Your Dreams

• Outcome: Pass
• Latest audit: Oct 22, 2026 · 8:02 PM UTC
• Version: 2.0.1

Overview

The skill’s job research, document creation and agreed application submissions fit its stated purpose, with ordinary privacy considerations.

Agree which applications it may submit and which documents and answers it may send; submission shares your information with employers or recruiting platforms. Keep the career project private, including packet.json and .layout.json files containing readable document text. Remove retained copies when you no longer need them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (10)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/application-management.md (reported line 11)May include surrounding context.

md

Start the record when preparing a chosen application. Discovery results belong in the shortlist until selected. Update the affected entry; keep prior submissions and approved revisions.

Use clear states:
- Prepared: the documents are ready; no submission has been established.
- Submitted: a confirmation page, receipt, employer portal status or equivalent evidence establishes completion.
- Blocked: a tool or employer barrier prevents progress.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/writing-methods.md (reported line 37)May include surrounding context.

md

## Application editing and formatting

Use the full editing guide as reference for Get Hired PRO's single consolidated review. Its standalone output instruction and input placeholder do not override the review task. If something cannot be stated factually and confidently, leave that statement out and present relevant facts positively without hedging; preserve the underlying accomplishments. This is writing judgment, not a claim-verification stage.

Read and apply the [formatting guide](formatting.md) in drafting, review and delivery. Supply its actual text to isolated workers. Use visible spacing between paragraphs and sections, and keep the applicant's preferred presentation readable.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_documents.py (reported line 308)May include surrounding context.

python

def test_utf8_packet_works_with_non_utf8_locale(self):
        path = self.directory / 'input.json'
        path.write_text(json.dumps(packet(), ensure_ascii=False), encoding='utf-8')
        env = os.environ.copy()
        env.update(LC_ALL='C', LANG='C', PYTHONUTF8='0', PYTHONCOERCECLOCALE='0', PYTHONDONTWRITEBYTECODE='1')
        out = self.directory / 'unicode'
        result = subprocess.run([sys.executable, str(ROOT / 'scripts/render_documents.py'), str(path), str(out)],

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The workflow instructs the agent to submit applications without warning that this sends the applicant's personal information to external recipients.

Medium

• Category: Output Handling
• Confidence: 91% confidence

Finding

The instruction to submit chosen applications is an actionable workflow step, not merely a description of an available tool. The skill does not warn that submission discloses résumé contents and other application data to employers or recruiting platforms, potentially creating an external record that cannot be fully recalled.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/formatting.md (reported line 10)May include surrounding context.

md

gnature with intentional spacing.
- Leave a visible gap between body paragraphs: the bundled standard layout uses **10 pt after each paragraph** and about **1.1 line spacing**, with 11 pt body text. A comparable readable layout in another document tool is suitable.
- Keep contact lines together, with modest separation; use a larger gap before the date, recipient and salutation. Keep the closing and signature together.
- Count the actual contact paragraphs and include `contact_lines_count` in the document packet, including zero when there are none. The Claw supplies this; do not ask the user to configure it. Put each complete paragraph in one array entry, without empty entries or embedded line breaks. Paragraph formatting supplies the gaps.
- Use the standard spacing profile by default. The optional compact profile still leaves **6 pt between body paragraphs**. Use it only when appropriate to the requested presentation; do not collapse paragraph spacing to force a page count.

## Résumé

The renderer writes an undisclosed JSON sidecar containing the full résumé text.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

In addition to the documented DOCX output, the renderer writes a .layout.json file containing all source blocks and rendered paragraphs, potentially duplicating personal and contact information in plaintext. The CLI documentation and printed status do not disclose this additional file or its contents.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_documents.py (reported line 311)May include surrounding context.

python

env = os.environ.copy()
        env.update(LC_ALL='C', LANG='C', PYTHONUTF8='0', PYTHONCOERCECLOCALE='0', PYTHONDONTWRITEBYTECODE='1')
        out = self.directory / 'unicode'
        result = subprocess.run([sys.executable, str(ROOT / 'scripts/render_documents.py'), str(path), str(out)],
                                env=env, capture_output=True)
        self.assertEqual(result.returncode, 0, result.stderr)
        self.assertEqual(json.loads((out / 'packet.json').read_text(encoding='utf-8'))['resume_blocks'][0]['text'], 'José Chen')

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_documents.py (reported line 331)May include surrounding context.

python

self.assertTrue((out / (name + '.pdf')).read_bytes().startswith(b'%PDF-'))
            _, paragraphs, expected_urls = inspect(out / (name + '.docx'))
            if shutil.which('pdftotext'):
                extracted = subprocess.check_output(['pdftotext', str(out / (name + '.pdf')), '-'], text=True)
                normalized = ' '.join(extracted.split())
                for paragraph in paragraphs:
                    self.assertIn(' '.join(''.join(paragraph.itertext()).split()), normalized)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_documents.py (reported line 336)May include surrounding context.

python

for paragraph in paragraphs:
                    self.assertIn(' '.join(''.join(paragraph.itertext()).split()), normalized)
            if shutil.which('pdfinfo'):
                urls = subprocess.check_output(['pdfinfo', '-url', str(out / (name + '.pdf'))], text=True)
                for url in expected_urls:
                    self.assertIn(url, urls)

Static analysis

No suspicious patterns detected.