ClawHub
Back to skill

Security audit

jobwatch

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed job-monitoring tool with sensitive data and scheduled behavior, but its high-impact capabilities are purpose-aligned, scoped, and mostly opt-in.

Install only if you want ongoing automated job monitoring. Prefer per-skill API keys in the skill .env, avoid broad JOBWATCH_ALLOW_HOST_CREDS=1 unless needed, review which destinations you grant in JOBWATCH_EGRESS_ALLOW, and remember that enabling cron will keep the watcher running until you disable the jobwatch cron entries.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
This code sends job-digest content, including job titles, companies, locations, follow-up reminders, and potentially profile-derived summaries, to Telegram whenever notify_mode() is set to telegram, but there is no consent or policy check enforced in this execution path. Because the skill handles sensitive job-seeking data, an autonomous scheduled send can leak private information to a third-party messaging service or to an unintended chat if configuration is wrong or consent state is stale.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The script directly edits the OpenClaw cron configuration and enables recurring jobs without any runtime confirmation, dry-run mode, or user-visible consent check at the moment of write. In this skill’s context, that matters because cron registration creates ongoing autonomous execution; if the script is invoked accidentally, by a wrapper, or before proper onboarding consent, it can persist background behavior beyond the user’s immediate awareness.

Credential Access

High
Category
Privilege Escalation
Content
"telegram_chat" (the allowFrom list) — comma-separated. The legacy value 1
          (or true/yes/all) still grants all three. Exactly these three are readable and
          nothing else; each read prints a stderr line naming the credential. Without
          this variable the skill reads only the .env file you filled in yourself.
      - name: JOBWATCH_HOME
        required: false
        description: >-
Confidence
87% confidence
Finding
The skill can read sensitive credentials from local .env files and, with JOBWATCH_ALLOW_HOST_CREDS, from host OpenClaw credential stores. Even though this is documented as opt-in and scoped, any skill capability that accesses host or local secrets materially increases risk because compromise or logic flaws could expose API keys, bot tokens, or chat identifiers.

Exfiltration Commands

High
Category
Prompt Injection
Content
| **Host credentials** | the OpenClaw OpenRouter key, the `openclaw.json` Telegram bot token, and the Telegram `allowFrom` list. Only these three; the auth store is opened read-only and no other profile is read. The opt-in is **per credential** (`openrouter` / `telegram_token` / `telegram_chat`), so granting one does not grant the others. | **off** | **yes** — returns `None` / raises unless that scope is named in `JOBWATCH_ALLOW_HOST_CREDS`; each read prints a stderr warning naming the credential |
| **Scheduled task** | `setup_cron.py` appends exactly three `jobwatch-*` entries to `~/.openclaw/cron/jobs.json`, after explicit onboarding consent, writing a timestamped `.bak` of the file first and leaving pre-existing jobs untouched. `openclaw.json` and all other host configuration are never modified. | **off** | **yes** — never runs unprompted |

This skill does **not**: apply to jobs on your behalf, send messages to anyone but you, read your mail or
browser data, install packages, modify any infrastructure config beyond its own cron entries, or make
any network call to a host not listed above.
Confidence
84% confidence
Finding
The skill has autonomous outbound messaging and data transmission paths, including Telegram notifications, third-party scraping, LLM judging, and cloud knowledge-base upload. Although these are documented and gated by consent, they still create real exfiltration channels through which personal profile data, job history, or message content could leave the local environment if misconfigured, over-broadened, or abused.

Static analysis

No suspicious patterns detected.