ClawHub
Back to skill

Security audit

求职自动申请

Security checks for vulnerabilities and agentic risk

Overview

This skill is a job-application automation guide, but it has unsafe defaults and unclear scope for sending personal applications to external platforms.

Review this carefully before installing. Use only for explicit job-search tasks, keep dry-run enabled first, require confirmation for every application, and avoid providing platform tokens or a resume/profile file unless you are comfortable with the agent using that data to submit applications externally.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
87% confidence
Finding
The documentation presents contradictory safety and feature boundaries: it states the free version does not support bulk automatic submission, yet surrounding guidance still encourages automated multi-application flows with limits like 10 submissions per day. This can mislead an agent or user into performing broader automated job submissions than intended, increasing the risk of accidental mass actions, policy violations on recruiting platforms, and misuse of personal data.

Intent-Code Divergence

Low
Confidence
91% confidence
Finding
The skill claims submissions are protected by a manual confirmation mechanism, but the parameter table says confirmation is disabled by default. In a tool that can submit job applications to external platforms using a user's personal profile, unsafe defaults materially increase the chance of unintended submissions and external disclosure of personal information.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger condition is broad enough to match generic productivity or automation requests, even when the user did not intend to invoke a job-application tool. Because this skill can read files, write files, execute commands, and send personal profile data to external recruiting platforms, overbroad activation raises the risk of inappropriate invocation and unintended high-impact actions.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill handles highly sensitive personal job profile data, including name, email, phone number, resume path, work authorization, and platform credentials, yet it does not prominently warn that this information may be transmitted to third-party recruitment platforms. In this context, the omission is dangerous because users may not understand the privacy consequences of activating the skill or enabling live submission.

Static analysis

No suspicious patterns detected.