JobClaw

• Outcome: Review
• Latest audit: May 29, 2026 · 9:29 PM UTC
• Version: 1.0.20260329-142ceea

Overview

JobClaw mostly does what it claims, but its scheduled workflow has unsafe automatic behavior that can modify records and may mishandle job-derived data.

Review before installing. Use a virtual environment instead of allowing system-wide pip changes, keep notifications disabled unless needed, protect config.json if you store Telegram/OpenClaw credentials, and avoid enabling scheduled runs until the daily runner stops injecting job text into Python code, validates archive-check URLs, and makes dry-run truly read-only.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        # HEAD check for status code
        result = subprocess.run(
            ["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}",
             "--max-time", "8", "--location", url],
            capture_output=True, text=True, timeout=12

• Confidence: 92% confidence
• Finding: The script passes a user/data-controlled URL directly to an external network client (curl) without constraining the scheme, host, or destination. Even though shell injection is avoided by using an argument list, this still enables server-side request forgery behavior: an attacker who can place a crafted job_url into jobs.csv can cause the archiver to make requests to internal services, localhost, cloud metadata endpoints, or other sensitive network targets during archive checks.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return False
        if 200 <= code < 400:
            # GET to check for dead phrases in body
            body_result = subprocess.run(
                ["curl", "-s", "--max-time", "8", "--location", url],
                capture_output=True, text=True, timeout=12
            )

• Confidence: 92% confidence
• Finding: This second curl invocation fetches the full response body from an untrusted URL and follows redirects, again allowing attacker-controlled outbound requests. In the JobClaw context, job postings and imported URLs are inherently untrusted, so the archive process can be abused as a local network probing primitive or to reach cloud-instance metadata services from the user's machine.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def install_package(package: str) -> bool:
    print(f"  Installing {package}...")
    result = subprocess.run(
        [sys.executable, "-m", "pip", "install", package, "--break-system-packages"],
        capture_output=True, text=True,
    )

• Confidence: 92% confidence
• Finding: The setup wizard executes pip installs from code, which changes the local Python environment and can pull and run third-party package installation logic. While the package names are hardcoded rather than user-controlled, invoking pip with --break-system-packages increases system modification risk and makes this behavior more security-sensitive than a normal job-search setup step.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"  ✅ {package} installed.")
        return True
    # Try without --break-system-packages
    result2 = subprocess.run(
        [sys.executable, "-m", "pip", "install", package],
        capture_output=True, text=True,
    )

• Confidence: 88% confidence
• Finding: This second subprocess call also runs pip from the setup script, causing code-driven environment modification and execution of package install hooks. Although arguments are passed safely as a list and there is no shell injection here, the behavior still expands the script's capability beyond simple configuration and carries supply-chain and environment integrity risk.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script performs an automatic archival action with `archiver.py --commit`, which mutates the user's job-tracking data even though the declared skill description only mentions searching, scoring, and saving results. In an automation context triggered by cron, undisclosed state-changing behavior is security-relevant because users may lose visibility into active opportunities or have records altered without informed consent.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The script sends notifications through `notify.py`/`send_summary`, but the skill metadata does not disclose any notification or messaging capability. Hidden outbound communication increases risk because a job-search skill may handle sensitive employment data, and users would not expect their search activity or job statistics to be transmitted elsewhere.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The setup wizard installs Python packages, including with --break-system-packages, which exceeds a minimal configuration role and can modify the host environment in a risky way. In a skill intended for job searching, automatic dependency installation is not inherently malicious, but it does meaningfully increase attack surface and operational risk.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad enough to match ordinary job-related conversation, so the skill may activate when the user did not intend to run an automation workflow with file writes, network access, or scheduled execution. In this skill's context, ambiguous activation is more dangerous because activation can lead to credential collection, persistence in local files, and external searches.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The setup flow collects bot tokens, chat IDs, profile details, and job preferences, then writes them to a persistent local config without warning about storage, retention, or exposure. These secrets and personal data could be accessed by other local processes, leaked through backups or logs, or reused to send unauthorized messages if the file permissions are weak.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger `top jobs` is generic enough to match ordinary conversation, which can cause the skill to activate when the user is merely asking a question rather than intending to run the command. In an agent environment, this can lead to unintended access to local job-tracker data and unexpected command execution without sufficiently explicit user intent.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The phrase `set up daily search` is broad and overlaps with normal assistant interactions about planning or advice, making accidental skill invocation plausible. Because this action may configure automation or cron-like scheduling, an unintended match could create persistent behavior the user did not explicitly authorize.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation includes notification configuration for Telegram and similar channels, implying transmission of job-search results and possibly profile-derived metadata to third-party services, but it does not clearly warn users about that data flow. In a job-search skill, the data may include sensitive career interests, recruiter contacts, and links to tracked applications, so silent or poorly disclosed external transmission creates a meaningful privacy and security risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script runs `archiver.py --commit` automatically in a scheduled workflow without any visible confirmation or warning at execution time. For a tool that manages job applications, silent destructive or state-changing actions can materially affect user records and decision-making, especially if archival criteria are wrong or unexpectedly broad.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: In non-interactive mode, the script installs packages automatically without an execution-time consent prompt. That makes unattended runs capable of altering the system and fetching external code, which is especially risky in automation contexts where the user may not realize package installation will occur.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The wizard collects Telegram/OpenClaw credentials and writes them into a local config.json file without warning about plaintext local storage. If that file is exposed through backups, weak permissions, multi-user systems, or accidental sharing, notification credentials can be stolen and abused.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.