ClawHub
Back to skill

Security audit

ApplyTOP

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-aligned, but it asks users to run an unpinned external npm CLI that handles API keys, CV data, and paid account actions.

Install only if you trust the ApplyTop npm package and publisher. Prefer a pinned reviewed version, avoid putting real API keys on the command line, do not use --insecure or custom API URLs unless you control the endpoint, and clear or rotate saved credentials on shared machines.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:15
Finding

Unpinned npm Package Retrieval and Execution

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:29
Finding

API Key Exposure and Unsafe Transport Options

Content
View full analysis
`APPLYTOP_API_KEY` env > saved file** (`~/.applytop/credentials.json`): ```bash applytop auth:login # prompts for the key, validates it, saves it applytop auth:login --api-key at_live_xxx export APPLYTOP_API_KEY=at_live_xxx # env var applytop jobs:search -q engineer --api-key at_live_xxx # per-command flag ``` ``` ```markdown Global options: `--api-key `, `--api-url ` (default `https://applytop.com/api/v1`), `--insecure` (dev-only, self-signed TLS), `--raw` (compact single-line JSON), `--version`, `--help`. ``` ### Technical Analysis Passing an API key through `--api-key` places the secret directly in the command line. Depending on the operating system and shell configuration, the value may be retained in shell history, terminal logs, audit records, process-monitoring output, or process argument listings. The CLI also exposes both an arbitrary `--api-url` option and an `--insecure` option that disables normal TLS certificate verification for development certificates. If these options are combined with an untrusted endpoint, authenticated requests and CV-related data may be sent without reliable server authentication. Reading `APPLYTOP_API_KEY` and `~/.applytop/credentials.json` is consistent with the Skill's declared authenticated API functionality and does not independently exceed minimum privilege. However, the audited repository does not include the CLI implementation, so file permissions, secret redaction, endpoint validation, and whether credentials are withheld from custom endpoints could not be verified. The document warns never to use `--insecure` against production, which reduces but does not eliminate misuse risk. ### A ...[truncated 1646 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

Every command except auth:* needs an API key, and the API is an ApplyTop Pro feature. Free accounts cannot create keys, and calls from a non-Pro account return 403 pro_required.

  1. Create a key at https://applytop.com/dashboard/api-keys (keys look like at_live_…).
  2. Provide it in one of three ways — precedence: --api-key flag > APPLYTOP_API_KEY env > saved file (~/.applytop/credentials.json):
bash
applytop auth:login                      # prompts for the key, validates it, saves it

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

Every command except auth:* needs an API key, and the API is an ApplyTop Pro feature. Free accounts cannot create keys, and calls from a non-Pro account return 403 pro_required.

  1. Create a key at https://applytop.com/dashboard/api-keys (keys look like at_live_…).
  2. Provide it in one of three ways — precedence: --api-key flag > APPLYTOP_API_KEY env > saved file (~/.applytop/credentials.json):
bash
applytop auth:login                      # prompts for the key, validates it, saves it

Rp1

Medium
Category
MCP Rug Pull
Confidence
82% confidence
Finding

The documentation recommends running the package via npx applytop without a pinned version. This causes code to be fetched and executed at runtime from the registry, which creates a supply-chain risk if the package is compromised, typosquatted, or a malicious new version is published. In the context of a skill that handles API keys and user CV/job data, executing an unpinned package is more dangerous because the fetched code could access those credentials and sensitive data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
78% confidence
Finding

This duplicate finding points to the same behavior: persistent storage of an API key for future sessions. Session persistence is not inherently malicious, but when implemented as a saved local credential file it becomes a security issue if the token is long-lived and readable by unintended parties. Because the tool operates on private account data and billable actions, unauthorized reuse of the persisted key has meaningful impact.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
## ⚠️ Authentication Required

Every command except `auth:*` needs an API key, and **the API is an ApplyTop Pro feature**. Free accounts cannot create keys, and calls from a non-Pro account return `403 pro_required`.

1. Create a key at **https://applytop.com/dashboard/api-keys** (keys look like `at_live_…`).
2. Provide it in one of three ways — **precedence: `--api-key` flag > `APPLYTOP_API_KEY` env > saved file** (`~/.applytop/credentials.json`):

Session Persistence

Medium
Category
Rogue Agent
Confidence
78% confidence
Finding

This duplicate finding points to the same behavior: persistent storage of an API key for future sessions. Session persistence is not inherently malicious, but when implemented as a saved local credential file it becomes a security issue if the token is long-lived and readable by unintended parties. Because the tool operates on private account data and billable actions, unauthorized reuse of the persisted key has meaningful impact.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
## ⚠️ Authentication Required

Every command except `auth:*` needs an API key, and **the API is an ApplyTop Pro feature**. Free accounts cannot create keys, and calls from a non-Pro account return `403 pro_required`.

1. Create a key at **https://applytop.com/dashboard/api-keys** (keys look like `at_live_...`).
2. Provide it in one of three ways — **precedence: `--api-key` flag > `APPLYTOP_API_KEY` env > saved file** (`~/.applytop/credentials.json`):

Static analysis

No suspicious patterns detected.