스킬 job-application-agent

📦

job-application-agent

Name: job-application-agent
Author: vaibhavarora14

콘텐츠 리비전 r1 높은 위험 🌐 네트워크 접근⚙️ 외부 명령어📁 파일 시스템 접근🔑 환경 변수⚡ 스크립트 포함

Manage Job Applications Safely

Job searches require repeated assessment, form completion, and accurate tracking. This skill organizes authorized applications with verified candidate data and submission safeguards.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

설치 전에 중지하고 확인을 요청하세요.

계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "job-application-agent" from https://skillstore.io/skills/vaibhavarora14-job-application-agent.md and its manifest at https://skillstore.io/api/skills/vaibhavarora14-job-application-agent/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/vaibhavarora14-job-application-agent.md 서명된 manifest GET /api/skills/vaibhavarora14-job-application-agent/manifest 서명된 lockfile GET /api/skills/vaibhavarora14-job-application-agent/lockfile

테스트해 보기

"job-application-agent" 사용 중입니다. Assess a senior backend role with remote work and an unclear sponsorship policy.

예상 결과:

Decision: Ask. The role and work mode match, but work authorization remains unclear. Submission is paused until sponsorship is confirmed.

"job-application-agent" 사용 중입니다. Check whether a previously seen role can be submitted.

예상 결과:

Submission blocked. The canonical job URL matches an existing ledger entry, so the application is treated as a hard duplicate.

"job-application-agent" 사용 중입니다. Review recent application outcomes.

예상 결과:

The review summarizes unique submissions, mature outcomes, interview quality, rejection reasons, source performance, and proposed targeting changes for candidate approval.

보안 감사

높은 위험

v1 • 2026. 8. 25. 버전별 보고서 열기

The audit confirmed 12 static findings and dismissed 388 scanner matches that were tests, validation syntax, fixed resource paths, or defensive encoding. Material risks include default external telemetry and job sharing, mutable automatic updates, and plaintext profile data passed in a macOS process argument. Static review was capped at 400/738 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

스캔된 파일

5,820

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (3)

높음

SKILL.md:14

Automatic Execution of a Mutable Updater

The workflow runs an updater from a hidden home directory and describes automatic npm checks. Updated code can differ from the audited package.

SKILL.md directly instructs execution of the managed updater and states that a background updater checks npm every hour by default.

높음

scripts/telemetry-client.mjs:81-85 scripts/job-application.mjs:1420-1426 scripts/telemetry-schema.mjs:41-60

Default-Enabled Job Activity Telemetry

The CLI sends installation, command, company, title, domain, fit, submission, and outcome metrics to an external relay without affirmative opt-in.

The configuration defaults to enabled, the first new-user command may send immediately, and the event schemas enumerate detailed job-search activity.

높음

scripts/source-community-client.mjs:24-25 scripts/source-community-client.mjs:261-278 scripts/job-application.mjs:1337-1343

Default-Enabled Sharing of Application Metadata

Confirmed applications automatically share exact public job URLs, company names, roles, channels, and discovery sources with an external relay.

The client defaults sharing to enabled, and ledger addition immediately invokes community synchronization with normalized job metadata.

기능 검토 항목 (12)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

높음

SKILL.md:14

Hidden file in home directory

At the beginning of each workflow, run the managed updater once when `~/.agents/job-application-agen

SKILL.md:14 instructs the agent to execute a managed updater from a hidden home directory. That mutable executable can replace audited behavior outside this package revision.

높음

scripts/secret-store.mjs:73-75

Process exec

exec('security', ['add-generic-password', '-a', account, '-s', service, '-U', '-w', raw], {

scripts/secret-store.mjs:73 passes the complete plaintext candidate profile to the macOS security command as an argument. Process arguments can expose sensitive profile data to local process inspection.

중간

SKILL.md:14

Hidden file access

At the beginning of each workflow, run the managed updater once when `~/.agents/job-application-agen

SKILL.md:14 instructs the agent to execute a managed updater from a hidden home directory. That mutable executable can replace audited behavior outside this package revision.

낮음

scripts/source-community-client.mjs:194

Fetch API call

let response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'content

scripts/source-community-client.mjs:194 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

낮음

scripts/source-community-client.mjs:202

Fetch API call

response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'content-typ

scripts/source-community-client.mjs:202 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

낮음

scripts/source-community-client.mjs:256

Fetch API call

const response = await this.fetch(`${this.endpoint}/v1/sources`, { method: 'POST', headers: { 'conte

scripts/source-community-client.mjs:256 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

낮음

scripts/source-community-client.mjs:306

Fetch API call

const response = await this.fetch(`${this.endpoint}/v1/jobs`, { method: 'POST', headers: { 'content-

scripts/source-community-client.mjs:306 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

낮음

scripts/telemetry-client.mjs:110

Fetch API call

const response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'conte

scripts/telemetry-client.mjs:110 sends installation credentials or structured job activity to the configured relay. This is real outbound data transmission, even though payload schemas limit direct identity fields.

낮음

scripts/telemetry-client.mjs:133

Fetch API call

let response = await this.fetch(`${this.endpoint}/v1/events`, { method: 'POST', headers: { 'content-

scripts/telemetry-client.mjs:133 sends installation credentials or structured job activity to the configured relay. This is real outbound data transmission, even though payload schemas limit direct identity fields.

낮음

scripts/telemetry-client.mjs:137

Fetch API call

response = await this.fetch(`${this.endpoint}/v1/events`, { method: 'POST', headers: { 'content-type

scripts/telemetry-client.mjs:137 sends installation credentials or structured job activity to the configured relay. This is real outbound data transmission, even though payload schemas limit direct identity fields.

낮음

scripts/source-community-client.mjs:16

Hardcoded URL

export const DEFAULT_SOURCE_COMMUNITY_ENDPOINT = process.env.JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_

scripts/source-community-client.mjs:16 defines the third-party relay used for default analytics or community sharing. It is a real external destination controlled outside the installed skill.

낮음

scripts/telemetry-client.mjs:9

Hardcoded URL

export const DEFAULT_TELEMETRY_ENDPOINT = process.env.JOB_APPLICATION_AGENT_TELEMETRY_URL ?? 'https:

scripts/telemetry-client.mjs:9 defines the third-party relay used for default analytics or community sharing. It is a real external destination controlled outside the installed skill.

위험 요인

🌐 네트워크 접근 (50)

⚙️ 외부 명령어 (50)

📁 파일 시스템 접근 (50)

🔑 환경 변수 (50)

⚡ 스크립트 포함 (3)

scripts/secret-store.mjs:62 scripts/secret-store.mjs:73 scripts/secret-store.mjs:105

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/vaibhavarora14-job-application-agent/security.svg)](https://skillstore.io/skills/vaibhavarora14-job-application-agent?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/vaibhavarora14-job-application-agent?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/vaibhavarora14-job-application-agent/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/vaibhavarora14-job-application-agent.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

vaibhavarora14. (2026). job-application-agent security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1

BibTeX 인용

@techreport{vaibhavarora14-vaibhavarora14-job-application-agent-2026,
  author = {vaibhavarora14},
  title = {job-application-agent security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "job-application-agent security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "vaibhavarora14"
date-released: "2026-08-25"
url: "https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1"
identifiers:
  - type: other
    value: "skillstore:vaibhavarora14-job-application-agent:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Organize a Personal Job Search

Create a verified profile, import a resume, and track each authorized application from discovery through outcome.

Assess Technical Roles

Compare postings with documented skills, eligibility, seniority, location, and compensation requirements before applying.

Manage Authorized Application Batches

Process an approved set of roles while enforcing duplicate checks, submission gates, and attention queues.

이 프롬프트를 사용해 보세요

Set Up My Profile

Create my job-search profile from this local resume: [path]. Ask only for required facts that the resume does not provide.

Assess One Role

Assess this job posting: [URL]. Check eligibility and must-have evidence, then explain whether I should review, skip, ask, or exclude it.

Prepare an Authorized Application

Prepare my application for [URL]. Use only verified profile facts, stop at protected questions, and request approval before submission.

Run and Review a Batch

Process these authorized job URLs: [URLs]. Enforce all eligibility and duplicate gates, queue blockers, record confirmed submissions, and summarize outcome metrics.

모범 사례

Use a verified resume and provide candidate facts directly when required information is missing.
Review eligibility, required evidence, compensation, and the final form before every submission.
Disable telemetry and community sharing before use when external data transmission is not acceptable.

피하기

Do not invent experience, authorization, compensation, or answers that the candidate did not provide.
Do not bypass duplicate gates, MFA, CAPTCHA, legal attestations, or browser confirmation requirements.
Do not grant routine autonomy without a clear destination, scope, and submission authorization.

자주 묻는 질문

Can this skill submit applications automatically?

Yes, but only within an authorized routine workflow that passes every eligibility, evidence, score, and duplicate gate.

Where is candidate data stored?

Profiles use macOS Keychain or Windows Credential Manager. Resumes and ledgers use an owner-only local state directory.

Does it work on Linux?

Most scripts can run, but secure profile storage intentionally rejects Linux.

Does it answer protected or sensitive questions?

No. It stops for demographic questions, government identifiers, legal attestations, MFA, CAPTCHA, and unsupported candidate judgments.

Does it send data over the network?

Yes. Analytics and community job sharing use a remote relay by default, and Google Docs resume imports contact Google.

Can I disable external analytics and sharing?

Yes. Telemetry and community source sharing have separate disable and reset controls.

개발자 세부 정보

작성자

vaibhavarora14

라이선스

MIT

Skillstore 리비전

버전 안내

작성자가 버전을 선언하지 않았습니다.

리포지토리

https://github.com/vaibhavarora14/job-application-agent/tree/f9da68c9ba15303d86ab52999a4101cf2287a16e/job-application-agent

참조

9d7f5ef6824a81aa9f78a05258ded434fce813aa

유지보수 최신성

2026. 8. 26.

사용량

1 다운로드 · 0 조회

파일 구조

📁 references/

📄 ANALYTICS.md

📄 APPLICATION_GUIDANCE.md

📄 AUTONOMY.md

📄 BROWSER_UPLOADS.md

📄 RUNS.md

📄 SCHEMAS.md

📄 SOURCES.json

📄 SOURCES.md

📁 scripts/

📄 job-application.mjs

📄 secret-store.mjs

📄 source-community-client.mjs

📄 source-community-schema.mjs

📄 telemetry-client.mjs

📄 telemetry-schema.mjs

📄 version.mjs

📄 windows-profile-store.ps1

📄 SKILL.md

📁 tests/

📄 job-application.test.mjs

📄 privacy-audit.test.mjs

📄 secret-store.test.mjs

📄 skill-contract.test.mjs

📄 source-community-client.test.mjs

📄 source-community-schema.test.mjs

📄 telemetry-client.test.mjs

📄 telemetry-schema.test.mjs

📄 version.test.mjs

📄 workflow-state.test.mjs

vaibhavarora14의 다른 스킬

전체 보기

📦

sync-before-work

Synchronize Git Before Editing

Code changes can begin from an outdated branch and create avoidable conflicts. This skill checks remote state and safely incorporates the default branch.

DevOps 및 인프라 보기

전체 보기

📦