Automate your Job Search
ReviewAudited by ClawScan on May 10, 2026.
Overview
This is a coherent Mokaru job-search integration, but it uses a Mokaru API key and can read or change persistent career data in the user's Mokaru account.
This skill appears purpose-aligned and does not show evidence of malicious behavior. Before installing, make sure you trust Mokaru and the skill publisher, use a limited API key if possible, and require confirmation before the agent updates or deletes resumes, contacts, profile details, education, skills, or application records.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If the API key has broad scopes, the agent can act on the user's Mokaru account within those permissions.
The skill requires a Mokaru account API key and sends it as a bearer token. This is expected for the Mokaru API, but the key is sensitive account authority.
Every request requires a Bearer token. The token is stored in the `MOKARU_API_KEY` environment variable and starts with `mk_`.
Use a dedicated, least-privilege Mokaru API key if available, keep it out of logs and shared prompts, and revoke or rotate it when no longer needed.
A mistaken or overly broad instruction could alter or delete job-search records, resumes, or profile data in Mokaru.
The documented API capabilities include creating, updating, and deleting persistent account data. This is aligned with career management, but these are state-changing operations.
PATCH `/v1/tracker/applications/:id` | Update application status, notes, priority ... DELETE `/v1/tracker/applications/:id` | Delete application ... PATCH `/v1/profile` | Update profile ... DELETE `/v1/resume/:id` | Delete resume
Review proposed changes before allowing writes or deletes, and ask the agent to confirm destructive actions such as deleting resumes, contacts, education, skills, or applications.
Personal details, resume content, work history, education, skills, contacts, and application status may be retrieved from or stored in Mokaru.
The skill can access and manage persistent personal career-profile data. That is expected for resume and application management, but it is sensitive information that may be reused across tasks.
**Career profile** - Manage your work experiences, education, skills, and personal details
Only store information you are comfortable keeping in Mokaru, review the provider's privacy practices, and periodically remove outdated or unnecessary personal data.
Users have less independent context for verifying the publisher or exact packaged version.
The registry metadata has sparse provenance, and the supplied SKILL.md frontmatter declares version 2.0.0. There is no executable install code, so this is a provenance note rather than evidence of harmful behavior.
Source: unknown; Homepage: none ... Version: 1.0.7
Verify the Mokaru service and documentation before providing an API key, especially because the skill can access and modify account data.