Job Auto Apply
Analysis
The skill is not overtly malicious, but it asks to automate sensitive job applications using personal data, platform accounts, and optional approval controls that users should review carefully before installing.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
“submits applications automatically or with user confirmation” ... “--auto-apply” ... “Submit applications (with confirmation if enabled)”
The skill explicitly supports submitting real job applications, and confirmation is configurable rather than mandatory. That is a high-impact external action because applications may contain personal data and can be difficult to retract.
“Captcha Handling - Use 2Captcha or Anti-Captcha services” ... “Captcha Blocks: Reduce frequency, use residential proxies”
The documentation recommends CAPTCHA-solving services and residential proxies for automation. That can bypass platform anti-abuse controls and may expose user activity to additional third parties.
“# This is a placeholder - in real implementation, this would:” ... “# 5. Submit application” ... “print(" ✅ Application submitted successfully")”The included script comments say the real application submission is not implemented, but the non-dry-run path can still report that an application was submitted successfully.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
“Authentication: OAuth 2.0” ... “Authentication: API Key” ... “Required Scopes: `r_basicprofile`, `r_emailaddress`, `w_member_social`” ... “Maintain authenticated sessions” ... “Handle cookie persistence”
The skill documentation requires platform credentials and persistent sessions, and it lists a broad LinkedIn social-write-style scope. The registry metadata declares no primary credential, env vars, or config paths, so the credential boundary is unclear.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
“full_name”, “email”, “phone”, “resume_path”, “work_authorization”, “salary_expectations”, “screening_answers”
The profile template stores sensitive personal and employment-application information. This is expected for a job-application skill, but it is still sensitive local data that may be reused in applications.