Fähigkeiten job-application-agent

📦

job-application-agent

Name: job-application-agent
Author: vaibhavarora14

Inhaltsrevision r1 Hohes Risiko 🌐 Netzwerkzugriff⚙️ Externe Befehle📁 Dateisystemzugriff🔑 Umgebungsvariablen⚡ Enthält Skripte

Manage Job Applications Safely

Job searches require repeated assessment, form completion, and accurate tracking. This skill organizes authorized applications with verified candidate data and submission safeguards.

Unterstützt: Claude Codex Code(CC)

⚠️ 38 Schlecht

Vor der Installation anhalten und eine Bestätigung anfordern.

Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "job-application-agent" from https://skillstore.io/skills/vaibhavarora14-job-application-agent.md and its manifest at https://skillstore.io/api/skills/vaibhavarora14-job-application-agent/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/vaibhavarora14-job-application-agent.md Signiertes manifest GET /api/skills/vaibhavarora14-job-application-agent/manifest Signiertes lockfile GET /api/skills/vaibhavarora14-job-application-agent/lockfile

Testen

„job-application-agent“ wird verwendet. Assess a senior backend role with remote work and an unclear sponsorship policy.

Erwartetes Ergebnis:

Decision: Ask. The role and work mode match, but work authorization remains unclear. Submission is paused until sponsorship is confirmed.

„job-application-agent“ wird verwendet. Check whether a previously seen role can be submitted.

Erwartetes Ergebnis:

Submission blocked. The canonical job URL matches an existing ledger entry, so the application is treated as a hard duplicate.

„job-application-agent“ wird verwendet. Review recent application outcomes.

Erwartetes Ergebnis:

The review summarizes unique submissions, mature outcomes, interview quality, rejection reasons, source performance, and proposed targeting changes for candidate approval.

Sicherheitsaudit

Hohes Risiko

v1 • 25.8.2026 Versionsbericht öffnen

The audit confirmed 12 static findings and dismissed 388 scanner matches that were tests, validation syntax, fixed resource paths, or defensive encoding. Material risks include default external telemetry and job sharing, mutable automatic updates, and plaintext profile data passed in a macOS process argument. Static review was capped at 400/738 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Gescannte Dateien

5,820

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (3)

Hoch

SKILL.md:14

Automatic Execution of a Mutable Updater

The workflow runs an updater from a hidden home directory and describes automatic npm checks. Updated code can differ from the audited package.

SKILL.md directly instructs execution of the managed updater and states that a background updater checks npm every hour by default.

Hoch

scripts/telemetry-client.mjs:81-85 scripts/job-application.mjs:1420-1426 scripts/telemetry-schema.mjs:41-60

Default-Enabled Job Activity Telemetry

The CLI sends installation, command, company, title, domain, fit, submission, and outcome metrics to an external relay without affirmative opt-in.

The configuration defaults to enabled, the first new-user command may send immediately, and the event schemas enumerate detailed job-search activity.

Hoch

scripts/source-community-client.mjs:24-25 scripts/source-community-client.mjs:261-278 scripts/job-application.mjs:1337-1343

Default-Enabled Sharing of Application Metadata

Confirmed applications automatically share exact public job URLs, company names, roles, channels, and discovery sources with an external relay.

The client defaults sharing to enabled, and ledger addition immediately invokes community synchronization with normalized job metadata.

Elemente der Fähigkeitsprüfung (12)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

SKILL.md:14

Hidden file in home directory

At the beginning of each workflow, run the managed updater once when `~/.agents/job-application-agen

SKILL.md:14 instructs the agent to execute a managed updater from a hidden home directory. That mutable executable can replace audited behavior outside this package revision.

Hoch

scripts/secret-store.mjs:73-75

Process exec

exec('security', ['add-generic-password', '-a', account, '-s', service, '-U', '-w', raw], {

scripts/secret-store.mjs:73 passes the complete plaintext candidate profile to the macOS security command as an argument. Process arguments can expose sensitive profile data to local process inspection.

Mittel

SKILL.md:14

Hidden file access

At the beginning of each workflow, run the managed updater once when `~/.agents/job-application-agen

SKILL.md:14 instructs the agent to execute a managed updater from a hidden home directory. That mutable executable can replace audited behavior outside this package revision.

Niedrig

scripts/source-community-client.mjs:194

Fetch API call

let response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'content

scripts/source-community-client.mjs:194 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

Niedrig

scripts/source-community-client.mjs:202

Fetch API call

response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'content-typ

scripts/source-community-client.mjs:202 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

Niedrig

scripts/source-community-client.mjs:256

Fetch API call

const response = await this.fetch(`${this.endpoint}/v1/sources`, { method: 'POST', headers: { 'conte

scripts/source-community-client.mjs:256 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

Niedrig

scripts/source-community-client.mjs:306

Fetch API call

const response = await this.fetch(`${this.endpoint}/v1/jobs`, { method: 'POST', headers: { 'content-

scripts/source-community-client.mjs:306 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

Niedrig

scripts/telemetry-client.mjs:110

Fetch API call

const response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'conte

scripts/telemetry-client.mjs:110 sends installation credentials or structured job activity to the configured relay. This is real outbound data transmission, even though payload schemas limit direct identity fields.

Niedrig

scripts/telemetry-client.mjs:133

Fetch API call

let response = await this.fetch(`${this.endpoint}/v1/events`, { method: 'POST', headers: { 'content-

scripts/telemetry-client.mjs:133 sends installation credentials or structured job activity to the configured relay. This is real outbound data transmission, even though payload schemas limit direct identity fields.

Niedrig

scripts/telemetry-client.mjs:137

Fetch API call

response = await this.fetch(`${this.endpoint}/v1/events`, { method: 'POST', headers: { 'content-type

scripts/telemetry-client.mjs:137 sends installation credentials or structured job activity to the configured relay. This is real outbound data transmission, even though payload schemas limit direct identity fields.

Niedrig

scripts/source-community-client.mjs:16

Hardcoded URL

export const DEFAULT_SOURCE_COMMUNITY_ENDPOINT = process.env.JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_

scripts/source-community-client.mjs:16 defines the third-party relay used for default analytics or community sharing. It is a real external destination controlled outside the installed skill.

Niedrig

scripts/telemetry-client.mjs:9

Hardcoded URL

export const DEFAULT_TELEMETRY_ENDPOINT = process.env.JOB_APPLICATION_AGENT_TELEMETRY_URL ?? 'https:

scripts/telemetry-client.mjs:9 defines the third-party relay used for default analytics or community sharing. It is a real external destination controlled outside the installed skill.

Risikofaktoren

🌐 Netzwerkzugriff (50)

⚙️ Externe Befehle (50)

📁 Dateisystemzugriff (50)

🔑 Umgebungsvariablen (50)

⚡ Enthält Skripte (3)

scripts/secret-store.mjs:62 scripts/secret-store.mjs:73 scripts/secret-store.mjs:105

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/vaibhavarora14-job-application-agent/security.svg)](https://skillstore.io/skills/vaibhavarora14-job-application-agent?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/vaibhavarora14-job-application-agent?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/vaibhavarora14-job-application-agent/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/vaibhavarora14-job-application-agent.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

vaibhavarora14. (2026). job-application-agent security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1

BibTeX-Zitat

@techreport{vaibhavarora14-vaibhavarora14-job-application-agent-2026,
  author = {vaibhavarora14},
  title = {job-application-agent security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "job-application-agent security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "vaibhavarora14"
date-released: "2026-08-25"
url: "https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1"
identifiers:
  - type: other
    value: "skillstore:vaibhavarora14-job-application-agent:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Organize a Personal Job Search

Create a verified profile, import a resume, and track each authorized application from discovery through outcome.

Assess Technical Roles

Compare postings with documented skills, eligibility, seniority, location, and compensation requirements before applying.

Manage Authorized Application Batches

Process an approved set of roles while enforcing duplicate checks, submission gates, and attention queues.

Diese Prompts ausprobieren

Set Up My Profile

Create my job-search profile from this local resume: [path]. Ask only for required facts that the resume does not provide.

Assess One Role

Assess this job posting: [URL]. Check eligibility and must-have evidence, then explain whether I should review, skip, ask, or exclude it.

Prepare an Authorized Application

Prepare my application for [URL]. Use only verified profile facts, stop at protected questions, and request approval before submission.

Run and Review a Batch

Process these authorized job URLs: [URLs]. Enforce all eligibility and duplicate gates, queue blockers, record confirmed submissions, and summarize outcome metrics.

Bewährte Praktiken

Use a verified resume and provide candidate facts directly when required information is missing.
Review eligibility, required evidence, compensation, and the final form before every submission.
Disable telemetry and community sharing before use when external data transmission is not acceptable.

Vermeiden

Do not invent experience, authorization, compensation, or answers that the candidate did not provide.
Do not bypass duplicate gates, MFA, CAPTCHA, legal attestations, or browser confirmation requirements.
Do not grant routine autonomy without a clear destination, scope, and submission authorization.

Häufig gestellte Fragen

Can this skill submit applications automatically?

Yes, but only within an authorized routine workflow that passes every eligibility, evidence, score, and duplicate gate.

Where is candidate data stored?

Profiles use macOS Keychain or Windows Credential Manager. Resumes and ledgers use an owner-only local state directory.

Does it work on Linux?

Most scripts can run, but secure profile storage intentionally rejects Linux.

Does it answer protected or sensitive questions?

No. It stops for demographic questions, government identifiers, legal attestations, MFA, CAPTCHA, and unsupported candidate judgments.

Does it send data over the network?

Yes. Analytics and community job sharing use a remote relay by default, and Google Docs resume imports contact Google.

Can I disable external analytics and sharing?

Yes. Telemetry and community source sharing have separate disable and reset controls.

Entwicklerdetails

Autor

vaibhavarora14

Lizenz

MIT

Skillstore-Revision

Versionshinweis

Der Autor hat keine Version angegeben.

Repository

https://github.com/vaibhavarora14/job-application-agent/tree/f9da68c9ba15303d86ab52999a4101cf2287a16e/job-application-agent

Ref.

9d7f5ef6824a81aa9f78a05258ded434fce813aa

Aktualität der Wartung

26.8.2026

Nutzung

1 Downloads · 0 Aufrufe

Dateistruktur

📁 references/

📄 ANALYTICS.md

📄 APPLICATION_GUIDANCE.md

📄 AUTONOMY.md

📄 BROWSER_UPLOADS.md

📄 RUNS.md

📄 SCHEMAS.md

📄 SOURCES.json

📄 SOURCES.md

📁 scripts/

📄 job-application.mjs

📄 secret-store.mjs

📄 source-community-client.mjs

📄 source-community-schema.mjs

📄 telemetry-client.mjs

📄 telemetry-schema.mjs

📄 version.mjs

📄 windows-profile-store.ps1

📄 SKILL.md

📁 tests/

📄 job-application.test.mjs

📄 privacy-audit.test.mjs

📄 secret-store.test.mjs

📄 skill-contract.test.mjs

📄 source-community-client.test.mjs

📄 source-community-schema.test.mjs

📄 telemetry-client.test.mjs

📄 telemetry-schema.test.mjs

📄 version.test.mjs

📄 workflow-state.test.mjs

Mehr von vaibhavarora14

Alle anzeigen

📦

sync-before-work

Synchronize Git Before Editing

Code changes can begin from an outdated branch and create avoidable conflicts. This skill checks remote state and safely incorporates the default branch.

DevOps & Infrastruktur Ansehen

Alle anzeigen

📦

linear-projects-write

Linear-Projekte über die CLI verwalten

von Bind

Teams benötigen eine schnelle, konsistente Einrichtung von Linear-Projekten, ohne zwischen Tools zu wechseln. Diese Skill führt Claude, Codex und Claude Code durch das Erstellen und Aktualisieren von Linear-Projekten mit einer Bun-CLI.

Produktivität Ansehen

📦

gws-gmail-watch

Gmail mit Pub/Sub-Streams überwachen

von googleworkspace

Teams benötigen zuverlässige Benachrichtigungen, wenn Gmail neue Nachrichten empfängt. Diese Skill hilft Claude, Codex und Claude Code, gws zu verwenden, um Gmail zu überwachen, Labels zu filtern und Ergebnisse zu streamen.

Produktivität Ansehen

📦

resume-optimizer

Optimieren Sie Ihren Lebenslauf für Zielpositionen

von zhangchenlai-dev

Jobsuchende haben oft Schwierigkeiten, Nachweise im Lebenslauf mit einer konkreten Stellenbeschreibung zu verknüpfen. Diese Skill prüft die Passung, schlägt gezielte Verbesserungen vor und bereitet wahrscheinliche Interviewfragen vor.

Schreiben & Inhalt Ansehen

📦

lark-doc

Lark-Dokumente sicher verwalten

von larksuite

Die Arbeit mit Lark-Dokumenten umfasst häufig Suche, Erstellung, Aktualisierungen und Medienverwaltung über mehrere Befehle hinweg. Diese Skill bietet geführte Workflows für Claude, Codex und Claude Code für sichere Lark-Dokumentoperationen.

Office & Berichte Ansehen

📦

pptx

PowerPoint-Präsentationen mit Python erstellen

von AutumnsGrove

Ausgefeilte PowerPoint-Präsentationen von Hand zu erstellen ist langsam und schwer wiederholbar. Dieser Skill führt Claude, Codex und Claude Code durch PPTX-Erstellung, Bearbeitung und Automatisierung mit python-pptx.

Office & Berichte Ansehen

📦

building-agents

Claude Code-Agenten erstellen

von C0ntr0lledCha0s

Die Erstellung zuverlässiger KI-Agenten erfordert klare Schemas, sichere Tools und wiederholbare Review-Schritte. Dieser Skill unterstützt Agentendesign, Validierung, Migration und Wartung für Claude Code-Workflows.

Programmierung & Entwicklung Ansehen

job-application-agent

Mit meinem Agent installieren

Agent-lesbare Ressourcen

Testen

Sicherheitsaudit

Bestätigte Sicherheitsbedenken (3)

Risikofaktoren

Berichtslink kopieren

Markdown-Badge

HTML-Badge

Einbettungskarte

APA-Zitat

BibTeX-Zitat

CITATION.cff

Skillstore-Score

Was Sie erstellen können

Organize a Personal Job Search

Assess Technical Roles

Manage Authorized Application Batches

Diese Prompts ausprobieren

Bewährte Praktiken

Vermeiden

Häufig gestellte Fragen

Entwicklerdetails

Mehr von vaibhavarora14

sync-before-work

Ähnliche Skills

linear-projects-write

gws-gmail-watch

resume-optimizer

lark-doc

pptx

building-agents