Job Auto Apply

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:31 AM UTC
• Version: 1.0.0

Overview

This job auto-apply skill is not proven malicious, but it asks for sensitive job-application automation and includes under-scoped guidance for platform evasion and personal data handling.

Install only if you are comfortable with a skill designed around automated job applications. Keep dry-run and per-application confirmation enabled, verify every factual answer before submission, do not use captcha-solving services or residential proxies, and store profile and credential data only in locations you explicitly approve.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill promises automated searching, applying, form filling, and platform integrations that are not actually implemented. This mismatch is dangerous because users or orchestrators may trust the skill to perform high-stakes actions or provide status accuracy when it only simulates behavior, leading to false assumptions, unsafe automation decisions, and possible disclosure of personal data to incomplete or placeholder workflows.

Credential Access

High

• Category: Privilege Escalation

Content

### Credential Storage
```python
from cryptography.fernet import Fernet
import keyring

# Store credentials securely
keyring.set_password("job_automation", "linkedin", encrypted_password)

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

### Credential Storage
```python
from cryptography.fernet import Fernet
import keyring

# Store credentials securely
keyring.set_password("job_automation", "linkedin", encrypted_password)

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill describes behavior that would write files such as profiles and application logs, but it declares no explicit tool scope or permissions boundary. In an agent environment, missing scope declarations can allow broader-than-expected file access and make it harder to enforce least privilege or review what the skill is allowed to modify.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The invocation guidance is broad enough that the skill could auto-activate on general job-seeking requests, even though it handles sensitive personal data and potentially submits applications. Overbroad triggers in an autonomous agent increase the chance of unintended activation, causing unauthorized processing of resumes, generation of application materials, or initiation of submission workflows without sufficiently explicit user intent.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The natural-language examples encourage direct invocation for automatic applications without clear constraints, making accidental or premature execution more likely. In this context, the risk is elevated because the skill operates on employment decisions and personal identity data, so unintended activation can have reputational, privacy, and consent consequences.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill discusses automated application submission and AI-generated screening answers without a strong warning about the risk of inaccurate, outdated, or fabricated personal information. In a job-application context, this can directly cause false statements to employers, reputational harm, rejection, or even legal and policy issues if work authorization, qualifications, or other sensitive facts are misstated.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file details automated handling of sensitive applicant data including contact details, work authorization, education, resumes, and screening responses, but does not place an upfront warning or explicit consent gate before describing collection and processing. For a job application skill, this creates privacy and compliance risk because users may not be clearly informed about what personal data is processed, stored, or submitted on their behalf.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The document explicitly recommends using third-party captcha-solving services and manual anti-detection measures to bypass platform friction intended to distinguish human from automated activity. In the context of a job auto-apply skill, this expands the capability from benign automation into evasion of platform safeguards, increasing risk of account sanctions, policy violations, and abuse at scale.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guidance recommends captcha-solving services and anti-blocking techniques without clearly warning that these practices may violate platform terms, trigger account bans, compromise integrity of applications, or expose data to third-party solvers. That omission is risky because the skill handles real user identities and credentials in a context where platform enforcement and privacy consequences are significant.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The troubleshooting section advises using residential proxies to reduce blocks, which is an evasion technique designed to circumvent platform defenses rather than support legitimate application submission. In this skill context, that makes the automation materially more dangerous because it enables scaling despite platform detection and can facilitate abusive or unauthorized mass applications.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The script writes application results to a local JSON file without explicit consent, minimization, or warning about what data may be stored. In the context of a job auto-apply tool, those results can include sensitive employment activity metadata and potentially personal information derived from the applicant profile or application workflow, creating avoidable privacy and local data exposure risk.

Static analysis

No suspicious patterns detected.