jobsearch-telegram

SUSPICIOUS. The skill's core behavior is mostly aligned with its stated Telegram job-search purpose and uses official Telegram endpoints, with no remote installer or unverifiable binary. Risk is elevated because it grants broad file and browser permissions, stores a bot token in plaintext, embeds that token in curl command lines, processes untrusted external content, and enables autonomous real-world job-application actions via headless polling. The 'hide actions' signal appears weak here because silence is limited to empty polls, not covert exfiltration.