jobhunter

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs storing plaintext credentials (memory/credentials.md) and using them for automated logins and MCP env vars, which means the agent will read secrets and likely emit them verbatim in actions/commands (browser.fill/login calls or env assignments), creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's hunt and apply workflows explicitly navigate to and scrape public job sites (see config/platforms.json and the hunt/apply code in SKILL.md using browser.navigate and browser.extract to read job listings and jobDescription from LinkedIn/Indeed/Google Jobs/etc.), so untrusted third‑party content is read and directly used to generate cover letters and drive actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's MCP Servers configuration will invoke npx to fetch and run remote npm packages at runtime—specifically "npx -y @modelcontextprotocol/server-google-sheets" and "npx -y @modelcontextprotocol/server-gmail"—which downloads and executes remote code and are required dependencies.