スキル job-application-agent

📦

job-application-agent

Name: job-application-agent
Author: vaibhavarora14

コンテンツリビジョン r1 高リスク 🌐 ネットワークアクセス⚙️ 外部コマンド📁 ファイルシステムへのアクセス🔑 環境変数⚡ スクリプトを含む

Manage Job Applications Safely

Job searches require repeated assessment, form completion, and accurate tracking. This skill organizes authorized applications with verified candidate data and submission safeguards.

対応: Claude Codex Code(CC)

⚠️ 38 不十分

インストール前に停止して確認を求めてください。

計画を確認し、ファイルを変更する前にユーザーの明示的な同意を得てください。

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "job-application-agent" from https://skillstore.io/skills/vaibhavarora14-job-application-agent.md and its manifest at https://skillstore.io/api/skills/vaibhavarora14-job-application-agent/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/vaibhavarora14-job-application-agent.md 署名済み manifest GET /api/skills/vaibhavarora14-job-application-agent/manifest 署名済み lockfile GET /api/skills/vaibhavarora14-job-application-agent/lockfile

テストする

「job-application-agent」を使用しています。 Assess a senior backend role with remote work and an unclear sponsorship policy.

期待される結果:

Decision: Ask. The role and work mode match, but work authorization remains unclear. Submission is paused until sponsorship is confirmed.

「job-application-agent」を使用しています。 Check whether a previously seen role can be submitted.

期待される結果:

Submission blocked. The canonical job URL matches an existing ledger entry, so the application is treated as a hard duplicate.

「job-application-agent」を使用しています。 Review recent application outcomes.

期待される結果:

The review summarizes unique submissions, mature outcomes, interview quality, rejection reasons, source performance, and proposed targeting changes for candidate approval.

セキュリティ監査

高リスク

v1 • 2026/8/25 バージョン別レポートを開く

The audit confirmed 12 static findings and dismissed 388 scanner matches that were tests, validation syntax, fixed resource paths, or defensive encoding. Material risks include default external telemetry and job sharing, mutable automatic updates, and plaintext profile data passed in a macOS process argument. Static review was capped at 400/738 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

スキャンされたファイル

5,820

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (3)

高

SKILL.md:14

Automatic Execution of a Mutable Updater

The workflow runs an updater from a hidden home directory and describes automatic npm checks. Updated code can differ from the audited package.

SKILL.md directly instructs execution of the managed updater and states that a background updater checks npm every hour by default.

高

scripts/telemetry-client.mjs:81-85 scripts/job-application.mjs:1420-1426 scripts/telemetry-schema.mjs:41-60

Default-Enabled Job Activity Telemetry

The CLI sends installation, command, company, title, domain, fit, submission, and outcome metrics to an external relay without affirmative opt-in.

The configuration defaults to enabled, the first new-user command may send immediately, and the event schemas enumerate detailed job-search activity.

高

scripts/source-community-client.mjs:24-25 scripts/source-community-client.mjs:261-278 scripts/job-application.mjs:1337-1343

Default-Enabled Sharing of Application Metadata

Confirmed applications automatically share exact public job URLs, company names, roles, channels, and discovery sources with an external relay.

The client defaults sharing to enabled, and ledger addition immediately invokes community synchronization with normalized job metadata.

機能レビュー項目 (12)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

高

SKILL.md:14

Hidden file in home directory

At the beginning of each workflow, run the managed updater once when `~/.agents/job-application-agen

SKILL.md:14 instructs the agent to execute a managed updater from a hidden home directory. That mutable executable can replace audited behavior outside this package revision.

高

scripts/secret-store.mjs:73-75

Process exec

exec('security', ['add-generic-password', '-a', account, '-s', service, '-U', '-w', raw], {

scripts/secret-store.mjs:73 passes the complete plaintext candidate profile to the macOS security command as an argument. Process arguments can expose sensitive profile data to local process inspection.

中

SKILL.md:14

Hidden file access

At the beginning of each workflow, run the managed updater once when `~/.agents/job-application-agen

SKILL.md:14 instructs the agent to execute a managed updater from a hidden home directory. That mutable executable can replace audited behavior outside this package revision.

低

scripts/source-community-client.mjs:194

Fetch API call

let response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'content

scripts/source-community-client.mjs:194 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

低

scripts/source-community-client.mjs:202

Fetch API call

response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'content-typ

scripts/source-community-client.mjs:202 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

低

scripts/source-community-client.mjs:256

Fetch API call

const response = await this.fetch(`${this.endpoint}/v1/sources`, { method: 'POST', headers: { 'conte

scripts/source-community-client.mjs:256 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

低

scripts/source-community-client.mjs:306

Fetch API call

const response = await this.fetch(`${this.endpoint}/v1/jobs`, { method: 'POST', headers: { 'content-

scripts/source-community-client.mjs:306 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

低

scripts/telemetry-client.mjs:110

Fetch API call

const response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'conte

scripts/telemetry-client.mjs:110 sends installation credentials or structured job activity to the configured relay. This is real outbound data transmission, even though payload schemas limit direct identity fields.

低

scripts/telemetry-client.mjs:133

Fetch API call

let response = await this.fetch(`${this.endpoint}/v1/events`, { method: 'POST', headers: { 'content-

scripts/telemetry-client.mjs:133 sends installation credentials or structured job activity to the configured relay. This is real outbound data transmission, even though payload schemas limit direct identity fields.

低

scripts/telemetry-client.mjs:137

Fetch API call

response = await this.fetch(`${this.endpoint}/v1/events`, { method: 'POST', headers: { 'content-type

scripts/telemetry-client.mjs:137 sends installation credentials or structured job activity to the configured relay. This is real outbound data transmission, even though payload schemas limit direct identity fields.

低

scripts/source-community-client.mjs:16

Hardcoded URL

export const DEFAULT_SOURCE_COMMUNITY_ENDPOINT = process.env.JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_

scripts/source-community-client.mjs:16 defines the third-party relay used for default analytics or community sharing. It is a real external destination controlled outside the installed skill.

低

scripts/telemetry-client.mjs:9

Hardcoded URL

export const DEFAULT_TELEMETRY_ENDPOINT = process.env.JOB_APPLICATION_AGENT_TELEMETRY_URL ?? 'https:

scripts/telemetry-client.mjs:9 defines the third-party relay used for default analytics or community sharing. It is a real external destination controlled outside the installed skill.

リスク要因

🌐 ネットワークアクセス (50)

⚙️ 外部コマンド (50)

📁 ファイルシステムへのアクセス (50)

🔑 環境変数 (50)

⚡ スクリプトを含む (3)

scripts/secret-store.mjs:62 scripts/secret-store.mjs:73 scripts/secret-store.mjs:105

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/vaibhavarora14-job-application-agent/security.svg)](https://skillstore.io/skills/vaibhavarora14-job-application-agent?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/vaibhavarora14-job-application-agent?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/vaibhavarora14-job-application-agent/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/vaibhavarora14-job-application-agent.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

vaibhavarora14. (2026). job-application-agent security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1

BibTeX形式の引用

@techreport{vaibhavarora14-vaibhavarora14-job-application-agent-2026,
  author = {vaibhavarora14},
  title = {job-application-agent security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "job-application-agent security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "vaibhavarora14"
date-released: "2026-08-25"
url: "https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1"
identifiers:
  - type: other
    value: "skillstore:vaibhavarora14-job-application-agent:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Organize a Personal Job Search

Create a verified profile, import a resume, and track each authorized application from discovery through outcome.

Assess Technical Roles

Compare postings with documented skills, eligibility, seniority, location, and compensation requirements before applying.

Manage Authorized Application Batches

Process an approved set of roles while enforcing duplicate checks, submission gates, and attention queues.

これらのプロンプトを試す

Set Up My Profile

Create my job-search profile from this local resume: [path]. Ask only for required facts that the resume does not provide.

Assess One Role

Assess this job posting: [URL]. Check eligibility and must-have evidence, then explain whether I should review, skip, ask, or exclude it.

Prepare an Authorized Application

Prepare my application for [URL]. Use only verified profile facts, stop at protected questions, and request approval before submission.

Run and Review a Batch

Process these authorized job URLs: [URLs]. Enforce all eligibility and duplicate gates, queue blockers, record confirmed submissions, and summarize outcome metrics.

ベストプラクティス

Use a verified resume and provide candidate facts directly when required information is missing.
Review eligibility, required evidence, compensation, and the final form before every submission.
Disable telemetry and community sharing before use when external data transmission is not acceptable.

回避

Do not invent experience, authorization, compensation, or answers that the candidate did not provide.
Do not bypass duplicate gates, MFA, CAPTCHA, legal attestations, or browser confirmation requirements.
Do not grant routine autonomy without a clear destination, scope, and submission authorization.

よくある質問

Can this skill submit applications automatically?

Yes, but only within an authorized routine workflow that passes every eligibility, evidence, score, and duplicate gate.

Where is candidate data stored?

Profiles use macOS Keychain or Windows Credential Manager. Resumes and ledgers use an owner-only local state directory.

Does it work on Linux?

Most scripts can run, but secure profile storage intentionally rejects Linux.

Does it answer protected or sensitive questions?

No. It stops for demographic questions, government identifiers, legal attestations, MFA, CAPTCHA, and unsupported candidate judgments.

Does it send data over the network?

Yes. Analytics and community job sharing use a remote relay by default, and Google Docs resume imports contact Google.

Can I disable external analytics and sharing?

Yes. Telemetry and community source sharing have separate disable and reset controls.

開発者情報

作成者

vaibhavarora14

ライセンス

MIT

Skillstore リビジョン

バージョンに関する注意

作者はバージョンを宣言していません。

リポジトリ

https://github.com/vaibhavarora14/job-application-agent/tree/f9da68c9ba15303d86ab52999a4101cf2287a16e/job-application-agent

参照

9d7f5ef6824a81aa9f78a05258ded434fce813aa

メンテナンスの新しさ

2026/8/26

利用状況

1 ダウンロード · 0 閲覧

ファイル構成

📁 references/

📄 ANALYTICS.md

📄 APPLICATION_GUIDANCE.md

📄 AUTONOMY.md

📄 BROWSER_UPLOADS.md

📄 RUNS.md

📄 SCHEMAS.md

📄 SOURCES.json

📄 SOURCES.md

📁 scripts/

📄 job-application.mjs

📄 secret-store.mjs

📄 source-community-client.mjs

📄 source-community-schema.mjs

📄 telemetry-client.mjs

📄 telemetry-schema.mjs

📄 version.mjs

📄 windows-profile-store.ps1

📄 SKILL.md

📁 tests/

📄 job-application.test.mjs

📄 privacy-audit.test.mjs

📄 secret-store.test.mjs

📄 skill-contract.test.mjs

📄 source-community-client.test.mjs

📄 source-community-schema.test.mjs

📄 telemetry-client.test.mjs

📄 telemetry-schema.test.mjs

📄 version.test.mjs

📄 workflow-state.test.mjs

vaibhavarora14 のその他のスキル

すべて表示

📦

sync-before-work

Synchronize Git Before Editing

Code changes can begin from an outdated branch and create avoidable conflicts. This skill checks remote state and safely incorporates the default branch.

DevOps＆インフラ表示

すべて表示

📦