Workopia — Jobs, Resumes & Career Advice

• Outcome: Pass
• Latest audit: May 28, 2026, 11:49 AM
• Version:
  1.1.0

Overview

Workopia is a clearly disclosed remote MCP integration for job search, resumes, and career advice, with the main caution being that resume and career details are sent to Workopia’s hosted service.

Install only if you are comfortable sending job-search prompts, resume text, and career questions to Workopia’s hosted MCP endpoint. Avoid including unnecessary sensitive personal details, and verify Workopia’s current privacy and pricing terms before relying on resume PDF generation or high-volume use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The skill advertises very broad trigger phrases such as 'career advice' and 'employment-related queries', which can cause the agent to invoke this external MCP service for a wide range of ordinary conversations. That increases unintended data sharing risk, especially because users may provide sensitive resume, employment history, compensation, or career-transition details without realizing they are being sent to a third-party service.

VirusTotal

VirusTotal findings are pending for this skill version.