ClawHub
Back to skill

Security audit

Teletalk AllJobs Gov Job Search

Security checks for vulnerabilities and agentic risk

Overview

This skill searches Teletalk government job listings and stores only local search preferences and confirmed applied job IDs, with no hidden or high-impact behavior found.

Before installing, understand that the skill will store your search keyword, excluded terms, and any job IDs you confirm as applied inside the skill folder, and it will send your search keyword to the Teletalk AllJobs API when searching.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The main described behavior—searching alljobs.teletalk.com.bd and filtering out excluded keywords—is implemented. However, the description also claims the skill can 'track applied job IDs' and save them after confirmation, but this code contains no logic to record, persist, confirm, or manage applied job IDs. Instead, it only reads a local preference file containing a search keyword and exclusion list, performs a GET request to the Teletalk API, filters out expired jobs, and outputs matching jobs. The local preference-file dependency is a minor undeclared resource detail, but the missing applied-ID tracking is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script hardcodes Intl.DateTimeFormat('en-GB', ...), which imposes a specific language/locale format on output. Under the policy, locale-specific behavior should offer user choice or be clearly justified; neither is present in this file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.