Compétences job-application-agent

📦

job-application-agent

Name: job-application-agent
Author: vaibhavarora14

Révision du contenu r1 Risque élevé 🌐 Accès réseau⚙️ Commandes externes📁 Accès au système de fichiers🔑 Variables d’environnement⚡ Contient des scripts

Manage Job Applications Safely

Job searches require repeated assessment, form completion, and accurate tracking. This skill organizes authorized applications with verified candidate data and submission safeguards.

Prend en charge: Claude Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

Arrêtez-vous et demandez confirmation avant l’installation.

Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "job-application-agent" from https://skillstore.io/skills/vaibhavarora14-job-application-agent.md and its manifest at https://skillstore.io/api/skills/vaibhavarora14-job-application-agent/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/vaibhavarora14-job-application-agent.md manifest signé GET /api/skills/vaibhavarora14-job-application-agent/manifest lockfile signé GET /api/skills/vaibhavarora14-job-application-agent/lockfile

Tester

Utilisation de « job-application-agent ». Assess a senior backend role with remote work and an unclear sponsorship policy.

Résultat attendu:

Decision: Ask. The role and work mode match, but work authorization remains unclear. Submission is paused until sponsorship is confirmed.

Utilisation de « job-application-agent ». Check whether a previously seen role can be submitted.

Résultat attendu:

Submission blocked. The canonical job URL matches an existing ledger entry, so the application is treated as a hard duplicate.

Utilisation de « job-application-agent ». Review recent application outcomes.

Résultat attendu:

The review summarizes unique submissions, mature outcomes, interview quality, rejection reasons, source performance, and proposed targeting changes for candidate approval.

Audit de sécurité

Risque élevé

v1 • 25/08/2026 Ouvrir le rapport versionné

The audit confirmed 12 static findings and dismissed 388 scanner matches that were tests, validation syntax, fixed resource paths, or defensive encoding. Material risks include default external telemetry and job sharing, mutable automatic updates, and plaintext profile data passed in a macOS process argument. Static review was capped at 400/738 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Fichiers analysés

5,820

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (3)

Élevé

SKILL.md:14

Automatic Execution of a Mutable Updater

The workflow runs an updater from a hidden home directory and describes automatic npm checks. Updated code can differ from the audited package.

SKILL.md directly instructs execution of the managed updater and states that a background updater checks npm every hour by default.

Élevé

scripts/telemetry-client.mjs:81-85 scripts/job-application.mjs:1420-1426 scripts/telemetry-schema.mjs:41-60

Default-Enabled Job Activity Telemetry

The CLI sends installation, command, company, title, domain, fit, submission, and outcome metrics to an external relay without affirmative opt-in.

The configuration defaults to enabled, the first new-user command may send immediately, and the event schemas enumerate detailed job-search activity.

Élevé

scripts/source-community-client.mjs:24-25 scripts/source-community-client.mjs:261-278 scripts/job-application.mjs:1337-1343

Default-Enabled Sharing of Application Metadata

Confirmed applications automatically share exact public job URLs, company names, roles, channels, and discovery sources with an external relay.

The client defaults sharing to enabled, and ledger addition immediately invokes community synchronization with normalized job metadata.

Éléments d’évaluation des capacités (12)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Élevé

SKILL.md:14

Hidden file in home directory

At the beginning of each workflow, run the managed updater once when `~/.agents/job-application-agen

SKILL.md:14 instructs the agent to execute a managed updater from a hidden home directory. That mutable executable can replace audited behavior outside this package revision.

Élevé

scripts/secret-store.mjs:73-75

Process exec

exec('security', ['add-generic-password', '-a', account, '-s', service, '-U', '-w', raw], {

scripts/secret-store.mjs:73 passes the complete plaintext candidate profile to the macOS security command as an argument. Process arguments can expose sensitive profile data to local process inspection.

Moyen

SKILL.md:14

Hidden file access

At the beginning of each workflow, run the managed updater once when `~/.agents/job-application-agen

SKILL.md:14 instructs the agent to execute a managed updater from a hidden home directory. That mutable executable can replace audited behavior outside this package revision.

Faible

scripts/source-community-client.mjs:194

Fetch API call

let response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'content

scripts/source-community-client.mjs:194 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

Faible

scripts/source-community-client.mjs:202

Fetch API call

response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'content-typ

scripts/source-community-client.mjs:202 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

Faible

scripts/source-community-client.mjs:256

Fetch API call

const response = await this.fetch(`${this.endpoint}/v1/sources`, { method: 'POST', headers: { 'conte

scripts/source-community-client.mjs:256 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

Faible

scripts/source-community-client.mjs:306

Fetch API call

const response = await this.fetch(`${this.endpoint}/v1/jobs`, { method: 'POST', headers: { 'content-

scripts/source-community-client.mjs:306 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

Faible

scripts/telemetry-client.mjs:110

Fetch API call

const response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'conte

scripts/telemetry-client.mjs:110 sends installation credentials or structured job activity to the configured relay. This is real outbound data transmission, even though payload schemas limit direct identity fields.

Faible

scripts/telemetry-client.mjs:133

Fetch API call

let response = await this.fetch(`${this.endpoint}/v1/events`, { method: 'POST', headers: { 'content-

scripts/telemetry-client.mjs:133 sends installation credentials or structured job activity to the configured relay. This is real outbound data transmission, even though payload schemas limit direct identity fields.

Faible

scripts/telemetry-client.mjs:137

Fetch API call

response = await this.fetch(`${this.endpoint}/v1/events`, { method: 'POST', headers: { 'content-type

scripts/telemetry-client.mjs:137 sends installation credentials or structured job activity to the configured relay. This is real outbound data transmission, even though payload schemas limit direct identity fields.

Faible

scripts/source-community-client.mjs:16

Hardcoded URL

export const DEFAULT_SOURCE_COMMUNITY_ENDPOINT = process.env.JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_

scripts/source-community-client.mjs:16 defines the third-party relay used for default analytics or community sharing. It is a real external destination controlled outside the installed skill.

Faible

scripts/telemetry-client.mjs:9

Hardcoded URL

export const DEFAULT_TELEMETRY_ENDPOINT = process.env.JOB_APPLICATION_AGENT_TELEMETRY_URL ?? 'https:

scripts/telemetry-client.mjs:9 defines the third-party relay used for default analytics or community sharing. It is a real external destination controlled outside the installed skill.

Facteurs de risque

🌐 Accès réseau (50)

⚙️ Commandes externes (50)

📁 Accès au système de fichiers (50)

🔑 Variables d’environnement (50)

⚡ Contient des scripts (3)

scripts/secret-store.mjs:62 scripts/secret-store.mjs:73 scripts/secret-store.mjs:105

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/vaibhavarora14-job-application-agent/security.svg)](https://skillstore.io/skills/vaibhavarora14-job-application-agent?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/vaibhavarora14-job-application-agent?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/vaibhavarora14-job-application-agent/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/vaibhavarora14-job-application-agent.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

vaibhavarora14. (2026). job-application-agent security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1

Citation BibTeX

@techreport{vaibhavarora14-vaibhavarora14-job-application-agent-2026,
  author = {vaibhavarora14},
  title = {job-application-agent security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "job-application-agent security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "vaibhavarora14"
date-released: "2026-08-25"
url: "https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1"
identifiers:
  - type: other
    value: "skillstore:vaibhavarora14-job-application-agent:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Organize a Personal Job Search

Create a verified profile, import a resume, and track each authorized application from discovery through outcome.

Assess Technical Roles

Compare postings with documented skills, eligibility, seniority, location, and compensation requirements before applying.

Manage Authorized Application Batches

Process an approved set of roles while enforcing duplicate checks, submission gates, and attention queues.

Essayez ces prompts

Set Up My Profile

Create my job-search profile from this local resume: [path]. Ask only for required facts that the resume does not provide.

Assess One Role

Assess this job posting: [URL]. Check eligibility and must-have evidence, then explain whether I should review, skip, ask, or exclude it.

Prepare an Authorized Application

Prepare my application for [URL]. Use only verified profile facts, stop at protected questions, and request approval before submission.

Run and Review a Batch

Process these authorized job URLs: [URLs]. Enforce all eligibility and duplicate gates, queue blockers, record confirmed submissions, and summarize outcome metrics.

Bonnes pratiques

Use a verified resume and provide candidate facts directly when required information is missing.
Review eligibility, required evidence, compensation, and the final form before every submission.
Disable telemetry and community sharing before use when external data transmission is not acceptable.

Éviter

Do not invent experience, authorization, compensation, or answers that the candidate did not provide.
Do not bypass duplicate gates, MFA, CAPTCHA, legal attestations, or browser confirmation requirements.
Do not grant routine autonomy without a clear destination, scope, and submission authorization.