📦

job-application-agent

Name: job-application-agent
Author: vaibhavarora14

مراجعة المحتوى r1 مخاطر عالية 🌐 الوصول إلى الشبكة⚙️ الأوامر الخارجية📁 الوصول إلى نظام الملفات🔑 متغيرات البيئة⚡ يحتوي على سكربتات

Manage Job Applications Safely

Job searches require repeated assessment, form completion, and accurate tracking. This skill organizes authorized applications with verified candidate data and submission safeguards.

يدعم: Claude Codex Code(CC)

⚠️ 38 ضعيف

توقف واطلب التأكيد قبل التثبيت.

راجع الخطة واحصل على موافقة صريحة من المستخدم قبل تغيير الملفات.

التثبيت باستخدام Agent لدي

انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.

طلب الوكيل

Review the Skillstore skill "job-application-agent" from https://skillstore.io/skills/vaibhavarora14-job-application-agent.md and its manifest at https://skillstore.io/api/skills/vaibhavarora14-job-application-agent/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.

موارد مهيّأة لـ Agents

استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.

تفاصيل Markdown GET /skills/vaibhavarora14-job-application-agent.md manifest موقَّع GET /api/skills/vaibhavarora14-job-application-agent/manifest lockfile موقَّع GET /api/skills/vaibhavarora14-job-application-agent/lockfile

اختبرها

جارٍ استخدام "job-application-agent". Assess a senior backend role with remote work and an unclear sponsorship policy.

النتيجة المتوقعة:

Decision: Ask. The role and work mode match, but work authorization remains unclear. Submission is paused until sponsorship is confirmed.

جارٍ استخدام "job-application-agent". Check whether a previously seen role can be submitted.

النتيجة المتوقعة:

Submission blocked. The canonical job URL matches an existing ledger entry, so the application is treated as a hard duplicate.

جارٍ استخدام "job-application-agent". Review recent application outcomes.

النتيجة المتوقعة:

The review summarizes unique submissions, mature outcomes, interview quality, rejection reasons, source performance, and proposed targeting changes for candidate approval.

التدقيق الأمني

مخاطر عالية

v1 • ٢٥‏/٨‏/٢٠٢٦ فتح التقرير المرتبط بالإصدار

The audit confirmed 12 static findings and dismissed 388 scanner matches that were tests, validation syntax, fixed resource paths, or defensive encoding. Material risks include default external telemetry and job sharing, mutable automatic updates, and plaintext profile data passed in a macOS process argument. Static review was capped at 400/738 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

الملفات التي تم فحصها

5,820

الأسطر التي تم تحليلها

عناصر المراجعة

تم تجاهل الإيجابيات الكاذبة

مخاوف أمنية مؤكدة (3)

مرتفع

SKILL.md:14

Automatic Execution of a Mutable Updater

The workflow runs an updater from a hidden home directory and describes automatic npm checks. Updated code can differ from the audited package.

SKILL.md directly instructs execution of the managed updater and states that a background updater checks npm every hour by default.

مرتفع

scripts/telemetry-client.mjs:81-85 scripts/job-application.mjs:1420-1426 scripts/telemetry-schema.mjs:41-60

Default-Enabled Job Activity Telemetry

The CLI sends installation, command, company, title, domain, fit, submission, and outcome metrics to an external relay without affirmative opt-in.

The configuration defaults to enabled, the first new-user command may send immediately, and the event schemas enumerate detailed job-search activity.

مرتفع

scripts/source-community-client.mjs:24-25 scripts/source-community-client.mjs:261-278 scripts/job-application.mjs:1337-1343

Default-Enabled Sharing of Application Metadata

Confirmed applications automatically share exact public job URLs, company names, roles, channels, and discovery sources with an external relay.

The client defaults sharing to enabled, and ledger addition immediately invokes community synchronization with normalized job metadata.

عناصر مراجعة القدرات (12)

هذه قدرات محلية حقيقية قد يُتوقع وجودها لهذه المهارة، لذا فهي تتطلب مراجعة ولكن لا تُحتسب كسلوك خبيث مؤكد.

مرتفع

SKILL.md:14

Hidden file in home directory

At the beginning of each workflow, run the managed updater once when `~/.agents/job-application-agen

SKILL.md:14 instructs the agent to execute a managed updater from a hidden home directory. That mutable executable can replace audited behavior outside this package revision.

مرتفع

scripts/secret-store.mjs:73-75

Process exec

exec('security', ['add-generic-password', '-a', account, '-s', service, '-U', '-w', raw], {

scripts/secret-store.mjs:73 passes the complete plaintext candidate profile to the macOS security command as an argument. Process arguments can expose sensitive profile data to local process inspection.

متوسط

SKILL.md:14

Hidden file access

At the beginning of each workflow, run the managed updater once when `~/.agents/job-application-agen

SKILL.md:14 instructs the agent to execute a managed updater from a hidden home directory. That mutable executable can replace audited behavior outside this package revision.

منخفض

scripts/source-community-client.mjs:194

Fetch API call

let response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'content

scripts/source-community-client.mjs:194 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

منخفض

scripts/source-community-client.mjs:202

Fetch API call

response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'content-typ

scripts/source-community-client.mjs:202 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

منخفض

scripts/source-community-client.mjs:256

Fetch API call

const response = await this.fetch(`${this.endpoint}/v1/sources`, { method: 'POST', headers: { 'conte

scripts/source-community-client.mjs:256 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

منخفض

scripts/source-community-client.mjs:306

Fetch API call

const response = await this.fetch(`${this.endpoint}/v1/jobs`, { method: 'POST', headers: { 'content-

scripts/source-community-client.mjs:306 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

منخفض

scripts/telemetry-client.mjs:110

Fetch API call

const response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'conte

scripts/telemetry-client.mjs:110 sends installation credentials or structured job activity to the configured relay. This is real outbound data transmission, even though payload schemas limit direct identity fields.

منخفض

scripts/telemetry-client.mjs:133

Fetch API call

let response = await this.fetch(`${this.endpoint}/v1/events`, { method: 'POST', headers: { 'content-

scripts/telemetry-client.mjs:133 sends installation credentials or structured job activity to the configured relay. This is real outbound data transmission, even though payload schemas limit direct identity fields.

منخفض

scripts/telemetry-client.mjs:137

Fetch API call

response = await this.fetch(`${this.endpoint}/v1/events`, { method: 'POST', headers: { 'content-type

scripts/telemetry-client.mjs:137 sends installation credentials or structured job activity to the configured relay. This is real outbound data transmission, even though payload schemas limit direct identity fields.

منخفض

scripts/source-community-client.mjs:16

Hardcoded URL

export const DEFAULT_SOURCE_COMMUNITY_ENDPOINT = process.env.JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_

scripts/source-community-client.mjs:16 defines the third-party relay used for default analytics or community sharing. It is a real external destination controlled outside the installed skill.

منخفض

scripts/telemetry-client.mjs:9

Hardcoded URL

export const DEFAULT_TELEMETRY_ENDPOINT = process.env.JOB_APPLICATION_AGENT_TELEMETRY_URL ?? 'https:

scripts/telemetry-client.mjs:9 defines the third-party relay used for default analytics or community sharing. It is a real external destination controlled outside the installed skill.

عوامل الخطر

🌐 الوصول إلى الشبكة (50)

⚙️ الأوامر الخارجية (50)

📁 الوصول إلى نظام الملفات (50)

🔑 متغيرات البيئة (50)

⚡ يحتوي على سكربتات (3)

scripts/secret-store.mjs:62 scripts/secret-store.mjs:73 scripts/secret-store.mjs:105

دقّقه: codex

شارك واستشهد بهذا التقرير

شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.

فتح التقرير المرتبط بالإصدار

نسخ رابط التقرير

https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

شارة Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/vaibhavarora14-job-application-agent/security.svg)](https://skillstore.io/skills/vaibhavarora14-job-application-agent?utm_source=security_passport_badge)

شارة HTML

<a href="https://skillstore.io/skills/vaibhavarora14-job-application-agent?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/vaibhavarora14-job-application-agent/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

بطاقة قابلة للتضمين

<iframe src="https://skillstore.io/embed/skills/vaibhavarora14-job-application-agent.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

الاستشهادات الأكاديمية (APA · BibTeX · CFF)

اقتباس APA

vaibhavarora14. (2026). job-application-agent security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1

اقتباس BibTeX

@techreport{vaibhavarora14-vaibhavarora14-job-application-agent-2026,
  author = {vaibhavarora14},
  title = {job-application-agent security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "job-application-agent security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "vaibhavarora14"
date-released: "2026-08-25"
url: "https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1"
identifiers:
  - type: other
    value: "skillstore:vaibhavarora14-job-application-agent:audit:1"
    description: "Skillstore immutable audit report identifier"

تقييم Skillstore

سبب هذا التقييم موثوقية الأدلة: متوسط

الهندسة المعمارية

قابلية الصيانة

المحتوى

المجتمع

الامتثال للمواصفات

ما الذي يمكنك بناؤه

Organize a Personal Job Search

Create a verified profile, import a resume, and track each authorized application from discovery through outcome.

Assess Technical Roles

Compare postings with documented skills, eligibility, seniority, location, and compensation requirements before applying.

Manage Authorized Application Batches

Process an approved set of roles while enforcing duplicate checks, submission gates, and attention queues.

جرّب هذه الموجّهات

Set Up My Profile

Create my job-search profile from this local resume: [path]. Ask only for required facts that the resume does not provide.

Assess One Role

Assess this job posting: [URL]. Check eligibility and must-have evidence, then explain whether I should review, skip, ask, or exclude it.

Prepare an Authorized Application

Prepare my application for [URL]. Use only verified profile facts, stop at protected questions, and request approval before submission.

Run and Review a Batch

Process these authorized job URLs: [URLs]. Enforce all eligibility and duplicate gates, queue blockers, record confirmed submissions, and summarize outcome metrics.

أفضل الممارسات

Use a verified resume and provide candidate facts directly when required information is missing.
Review eligibility, required evidence, compensation, and the final form before every submission.
Disable telemetry and community sharing before use when external data transmission is not acceptable.

تجنب

Do not invent experience, authorization, compensation, or answers that the candidate did not provide.
Do not bypass duplicate gates, MFA, CAPTCHA, legal attestations, or browser confirmation requirements.
Do not grant routine autonomy without a clear destination, scope, and submission authorization.