Habilidades job-application-agent

📦

job-application-agent

Name: job-application-agent
Author: vaibhavarora14

Revisão do conteúdo r1 Risco alto 🌐 Acesso à rede⚙️ Comandos externos📁 Acesso ao sistema de arquivos🔑 Variáveis de ambiente⚡ Contém scripts

Manage Job Applications Safely

Job searches require repeated assessment, form completion, and accurate tracking. This skill organizes authorized applications with verified candidate data and submission safeguards.

Suporta: Claude Codex Code(CC)

⚠️ 38 Ruim

Pare e solicite confirmação antes de instalar.

Revise o plano e obtenha o consentimento explícito do usuário antes de alterar arquivos.

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente

Review the Skillstore skill "job-application-agent" from https://skillstore.io/skills/vaibhavarora14-job-application-agent.md and its manifest at https://skillstore.io/api/skills/vaibhavarora14-job-application-agent/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Detalhe em Markdown GET /skills/vaibhavarora14-job-application-agent.md manifest assinado GET /api/skills/vaibhavarora14-job-application-agent/manifest lockfile assinado GET /api/skills/vaibhavarora14-job-application-agent/lockfile

Testar

Usando "job-application-agent". Assess a senior backend role with remote work and an unclear sponsorship policy.

Resultado esperado:

Decision: Ask. The role and work mode match, but work authorization remains unclear. Submission is paused until sponsorship is confirmed.

Usando "job-application-agent". Check whether a previously seen role can be submitted.

Resultado esperado:

Submission blocked. The canonical job URL matches an existing ledger entry, so the application is treated as a hard duplicate.

Usando "job-application-agent". Review recent application outcomes.

Resultado esperado:

The review summarizes unique submissions, mature outcomes, interview quality, rejection reasons, source performance, and proposed targeting changes for candidate approval.

Auditoria de segurança

Risco alto

v1 • 25/08/2026 Abrir o relatório versionado

The audit confirmed 12 static findings and dismissed 388 scanner matches that were tests, validation syntax, fixed resource paths, or defensive encoding. Material risks include default external telemetry and job sharing, mutable automatic updates, and plaintext profile data passed in a macOS process argument. Static review was capped at 400/738 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Arquivos analisados

5,820

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Preocupações de segurança confirmadas (3)

Alto

SKILL.md:14

Automatic Execution of a Mutable Updater

The workflow runs an updater from a hidden home directory and describes automatic npm checks. Updated code can differ from the audited package.

SKILL.md directly instructs execution of the managed updater and states that a background updater checks npm every hour by default.

Alto

scripts/telemetry-client.mjs:81-85 scripts/job-application.mjs:1420-1426 scripts/telemetry-schema.mjs:41-60

Default-Enabled Job Activity Telemetry

The CLI sends installation, command, company, title, domain, fit, submission, and outcome metrics to an external relay without affirmative opt-in.

The configuration defaults to enabled, the first new-user command may send immediately, and the event schemas enumerate detailed job-search activity.

Alto

scripts/source-community-client.mjs:24-25 scripts/source-community-client.mjs:261-278 scripts/job-application.mjs:1337-1343

Default-Enabled Sharing of Application Metadata

Confirmed applications automatically share exact public job URLs, company names, roles, channels, and discovery sources with an external relay.

The client defaults sharing to enabled, and ledger addition immediately invokes community synchronization with normalized job metadata.

Itens de revisão de capacidade (12)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

SKILL.md:14

Hidden file in home directory

At the beginning of each workflow, run the managed updater once when `~/.agents/job-application-agen

SKILL.md:14 instructs the agent to execute a managed updater from a hidden home directory. That mutable executable can replace audited behavior outside this package revision.

Alto

scripts/secret-store.mjs:73-75

Process exec

exec('security', ['add-generic-password', '-a', account, '-s', service, '-U', '-w', raw], {

scripts/secret-store.mjs:73 passes the complete plaintext candidate profile to the macOS security command as an argument. Process arguments can expose sensitive profile data to local process inspection.

Médio

SKILL.md:14

Hidden file access

At the beginning of each workflow, run the managed updater once when `~/.agents/job-application-agen

SKILL.md:14 instructs the agent to execute a managed updater from a hidden home directory. That mutable executable can replace audited behavior outside this package revision.

Baixo

scripts/source-community-client.mjs:194

Fetch API call

let response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'content

scripts/source-community-client.mjs:194 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

Baixo

scripts/source-community-client.mjs:202

Fetch API call

response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'content-typ

scripts/source-community-client.mjs:202 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

Baixo

scripts/source-community-client.mjs:256

Fetch API call

const response = await this.fetch(`${this.endpoint}/v1/sources`, { method: 'POST', headers: { 'conte

scripts/source-community-client.mjs:256 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

Baixo

scripts/source-community-client.mjs:306

Fetch API call

const response = await this.fetch(`${this.endpoint}/v1/jobs`, { method: 'POST', headers: { 'content-

scripts/source-community-client.mjs:306 sends relay credentials, source metadata, or job metadata to an external service. The behavior is disclosed but enabled without affirmative opt-in.

Baixo

scripts/telemetry-client.mjs:110

Fetch API call

const response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'conte

scripts/telemetry-client.mjs:110 sends installation credentials or structured job activity to the configured relay. This is real outbound data transmission, even though payload schemas limit direct identity fields.

Baixo

scripts/telemetry-client.mjs:133

Fetch API call

let response = await this.fetch(`${this.endpoint}/v1/events`, { method: 'POST', headers: { 'content-

scripts/telemetry-client.mjs:133 sends installation credentials or structured job activity to the configured relay. This is real outbound data transmission, even though payload schemas limit direct identity fields.

Baixo

scripts/telemetry-client.mjs:137

Fetch API call

response = await this.fetch(`${this.endpoint}/v1/events`, { method: 'POST', headers: { 'content-type

scripts/telemetry-client.mjs:137 sends installation credentials or structured job activity to the configured relay. This is real outbound data transmission, even though payload schemas limit direct identity fields.

Baixo

scripts/source-community-client.mjs:16

Hardcoded URL

export const DEFAULT_SOURCE_COMMUNITY_ENDPOINT = process.env.JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_

scripts/source-community-client.mjs:16 defines the third-party relay used for default analytics or community sharing. It is a real external destination controlled outside the installed skill.

Baixo

scripts/telemetry-client.mjs:9

Hardcoded URL

export const DEFAULT_TELEMETRY_ENDPOINT = process.env.JOB_APPLICATION_AGENT_TELEMETRY_URL ?? 'https:

scripts/telemetry-client.mjs:9 defines the third-party relay used for default analytics or community sharing. It is a real external destination controlled outside the installed skill.

Fatores de risco

🌐 Acesso à rede (50)

⚙️ Comandos externos (50)

📁 Acesso ao sistema de arquivos (50)

🔑 Variáveis de ambiente (50)

⚡ Contém scripts (3)

scripts/secret-store.mjs:62 scripts/secret-store.mjs:73 scripts/secret-store.mjs:105

Auditado por: codex

Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado

Copiar link do relatório

https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/vaibhavarora14-job-application-agent/security.svg)](https://skillstore.io/skills/vaibhavarora14-job-application-agent?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/vaibhavarora14-job-application-agent?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/vaibhavarora14-job-application-agent/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/vaibhavarora14-job-application-agent.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

vaibhavarora14. (2026). job-application-agent security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1

Citação BibTeX

@techreport{vaibhavarora14-vaibhavarora14-job-application-agent-2026,
  author = {vaibhavarora14},
  title = {job-application-agent security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "job-application-agent security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "vaibhavarora14"
date-released: "2026-08-25"
url: "https://skillstore.io/skills/vaibhavarora14-job-application-agent/audits/1"
identifiers:
  - type: other
    value: "skillstore:vaibhavarora14-job-application-agent:audit:1"
    description: "Skillstore immutable audit report identifier"

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Médio

Arquitetura

Manutenibilidade

Conteúdo

Comunidade

Conformidade com a especificação

O que você pode criar

Organize a Personal Job Search

Create a verified profile, import a resume, and track each authorized application from discovery through outcome.

Assess Technical Roles

Compare postings with documented skills, eligibility, seniority, location, and compensation requirements before applying.

Manage Authorized Application Batches

Process an approved set of roles while enforcing duplicate checks, submission gates, and attention queues.

Teste estes prompts

Set Up My Profile

Create my job-search profile from this local resume: [path]. Ask only for required facts that the resume does not provide.

Assess One Role

Assess this job posting: [URL]. Check eligibility and must-have evidence, then explain whether I should review, skip, ask, or exclude it.

Prepare an Authorized Application

Prepare my application for [URL]. Use only verified profile facts, stop at protected questions, and request approval before submission.

Run and Review a Batch

Process these authorized job URLs: [URLs]. Enforce all eligibility and duplicate gates, queue blockers, record confirmed submissions, and summarize outcome metrics.

Boas práticas

Use a verified resume and provide candidate facts directly when required information is missing.
Review eligibility, required evidence, compensation, and the final form before every submission.
Disable telemetry and community sharing before use when external data transmission is not acceptable.

Evitar

Do not invent experience, authorization, compensation, or answers that the candidate did not provide.
Do not bypass duplicate gates, MFA, CAPTCHA, legal attestations, or browser confirmation requirements.
Do not grant routine autonomy without a clear destination, scope, and submission authorization.

Perguntas frequentes

Can this skill submit applications automatically?

Yes, but only within an authorized routine workflow that passes every eligibility, evidence, score, and duplicate gate.

Where is candidate data stored?

Profiles use macOS Keychain or Windows Credential Manager. Resumes and ledgers use an owner-only local state directory.

Does it work on Linux?

Most scripts can run, but secure profile storage intentionally rejects Linux.

Does it answer protected or sensitive questions?

No. It stops for demographic questions, government identifiers, legal attestations, MFA, CAPTCHA, and unsupported candidate judgments.

Does it send data over the network?

Yes. Analytics and community job sharing use a remote relay by default, and Google Docs resume imports contact Google.

Can I disable external analytics and sharing?

Yes. Telemetry and community source sharing have separate disable and reset controls.

Detalhes do desenvolvedor

Autor

vaibhavarora14

Licença

MIT

Revisão da Skillstore

Aviso de versão

O autor não declarou uma versão.

Repositório

https://github.com/vaibhavarora14/job-application-agent/tree/f9da68c9ba15303d86ab52999a4101cf2287a16e/job-application-agent

Referência

9d7f5ef6824a81aa9f78a05258ded434fce813aa

Atualidade da manutenção

26/08/2026

Uso

1 downloads · 0 visualizações

Estrutura de arquivos

📁 references/

📄 ANALYTICS.md

📄 APPLICATION_GUIDANCE.md

📄 AUTONOMY.md

📄 BROWSER_UPLOADS.md

📄 RUNS.md

📄 SCHEMAS.md

📄 SOURCES.json

📄 SOURCES.md

📁 scripts/

📄 job-application.mjs

📄 secret-store.mjs

📄 source-community-client.mjs

📄 source-community-schema.mjs

📄 telemetry-client.mjs

📄 telemetry-schema.mjs

📄 version.mjs

📄 windows-profile-store.ps1

📄 SKILL.md

📁 tests/

📄 job-application.test.mjs

📄 privacy-audit.test.mjs

📄 secret-store.test.mjs

📄 skill-contract.test.mjs

📄 source-community-client.test.mjs

📄 source-community-schema.test.mjs

📄 telemetry-client.test.mjs

📄 telemetry-schema.test.mjs

📄 version.test.mjs

📄 workflow-state.test.mjs

Mais de vaibhavarora14

Ver tudo

📦

sync-before-work

Synchronize Git Before Editing

Code changes can begin from an outdated branch and create avoidable conflicts. This skill checks remote state and safely incorporates the default branch.

DevOps e infraestrutura Ver

Ver tudo

📦

linear-projects-write

Gerencie Projetos do Linear pela CLI

por Bind

Equipes precisam de uma configuração rápida e consistente de projetos do Linear sem alternar entre ferramentas. Esta skill orienta Claude, Codex e Claude Code na criação e atualização de projetos do Linear com uma CLI Bun.

Produtividade Ver

📦

gws-gmail-watch

Monitorar Gmail com fluxos Pub/Sub

por googleworkspace

Equipes precisam de avisos confiáveis quando o Gmail recebe novas mensagens. Esta skill ajuda Claude, Codex e Claude Code a usar gws para monitorar o Gmail, filtrar rótulos e transmitir resultados.

Produtividade Ver

📦

resume-optimizer

Otimize seu currículo para cargos-alvo

por zhangchenlai-dev

Candidatos a emprego muitas vezes têm dificuldade para conectar evidências do currículo a uma descrição de vaga específica. Esta skill avalia a adequação, sugere melhorias focadas e prepara prováveis perguntas de entrevista.

Escrita e conteúdo Ver

📦

lark-doc

Gerencie Documentos Lark com Segurança

por larksuite

O trabalho com documentos Lark frequentemente abrange busca, criação, atualizações e gerenciamento de mídia em vários comandos. Esta skill fornece fluxos de trabalho guiados para Claude, Codex e Claude Code para operações seguras em documentos Lark.

Office e relatórios Ver

📦

pptx

Criar apresentações do PowerPoint com Python

por AutumnsGrove

Criar apresentações do PowerPoint polidas manualmente é lento e difícil de repetir. Esta skill orienta Claude, Codex e Claude Code na criação, edição e automação de PPTX com python-pptx.

Office e relatórios Ver

📦

building-agents

Criar Agentes do Claude Code

por C0ntr0lledCha0s

Criar agentes de IA confiáveis exige schemas claros, ferramentas seguras e etapas de revisão repetíveis. Esta skill orienta o design, a validação, a migração e a manutenção de agentes para workflows do Claude Code.

Programação e desenvolvimento Ver

job-application-agent

Instalar com meu Agente

Recursos legíveis por agentes

Testar

Auditoria de segurança

Preocupações de segurança confirmadas (3)

Fatores de risco

Copiar link do relatório

Badge Markdown

Badge HTML

Cartão incorporável

Citação APA

Citação BibTeX

CITATION.cff

Pontuação do Skillstore

O que você pode criar

Organize a Personal Job Search

Assess Technical Roles

Manage Authorized Application Batches

Teste estes prompts

Boas práticas

Evitar

Perguntas frequentes

Detalhes do desenvolvedor

Mais de vaibhavarora14

sync-before-work

Habilidades relacionadas

linear-projects-write

gws-gmail-watch

resume-optimizer

lark-doc

pptx

building-agents