Claude Code, Skill
Job Seeker
Let your AI coding agent apply to jobs for you.
Compatibility: Not stated.
Grade D
Two or more Medium findings, or a High finding. Only try it in a sandbox.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 290d466430ee, unchanged since the check below.
Pattern found, check before installing
The checks matched a pattern that needs a closer look. It does not mean the code is harmful. Read the quoted lines below.
- OBFUSCATION_RUNS_ENCODED_PAYLOAD High
decodes and runs an encoded payload (always High)
OBFUSCATION_RUNS_ENCODED_PAYLOAD
Why this grade
- OBFUSCATION_RUNS_ENCODED_PAYLOAD High
Decodes and runs an encoded payload (for example eval with atob or base64).
scripts/batch-easy-apply.js, line 124
evalJS(`(function(){var all=document.querySelectorAll('div,section,form');for(var i=0;i<all.length;i++){if(all[i].textContent.includes('Apply to')&&all[i].offsetHeight>100){var inp
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
scripts/generate-cv.js, line 589
fs.unlinkSync(tempHtmlPath);
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach mail.google.com. The description does not name that host. can reach cognito-idp.. The description does not name that host. can reach api.groq.com. The description does not name that host. can reach docs.google.com. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
.agents/skills/browser-automation/SKILL.md, line 305
node .agents/skills/browser-automation/scripts/browser.js exec eval "(async () => { const r = await fetch('/api/data'); return JSON.stringify(await r.json()) })()"
.agents/skills/browser-automation/references/efficiency-patterns.md, line 45
node .agents/skills/browser-automation/scripts/browser.js exec eval "(async () => { const r = await fetch('/api/data'); return JSON.stringify(await r.json()) })()"
.agents/skills/browser-automation/references/parallel-agents.md, line 44
node .agents/skills/browser-automation/scripts/browser.js exec eval "(async()=>{var r=await fetch('https://mail.google.com/mail/feed/atom');return await r.text()})()" --tab gmail
Show more
.agents/skills/browser-automation/references/token-extraction.md, line 49
curl -X POST "https://cognito-idp.<region>.amazonaws.com/" \
.agents/skills/browser-automation/sites/gmail_com/guide.md, line 204
er.js exec eval "(async()=>{var r=await fetch('https://mail.google.com/mail/feed/atom'
.agents/skills/browser-automation/sites/gmail_com/guide.md, line 214
var r=await fetch('https://mail.google.com/mail/feed/atom');
.agents/skills/browser-automation/sites/gmail_com/guide.md, line 243
er.js exec eval "(async()=>{var r=await fetch('https://mail.google.com/mail/feed/atom'
.agents/skills/browser-automation/sites/gmail_com/guide.md, line 823
er.js exec eval "(async()=>{var r=await fetch('https://mail.google.com/mail/feed/atom'
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
scripts/dashboard.js, line 26
const ENV_PATH = path.join(REPO_ROOT, '.env');
scripts/dashboard.js, line 36
console.error('No .env found. Run the onboarding skill first.');
scripts/db.js, line 5
* Reads DATABASE_URL from .env (repo root), runs SQL, prints JSON.
Show more
scripts/db.js, line 24
const ENV_PATH = path.join(REPO_ROOT, '.env');
scripts/db.js, line 26
// --- .env parsing (manual, no dotenv dependency) ---
scripts/db.js, line 29
fail(`No .env found at ${envPath}. Run the onboarding skill first.`);
scripts/db.js, line 93
if (!env.DATABASE_URL) fail('DATABASE_URL is not set in .env');
scripts/db.js, line 95
// (same security), this just silences the deprecation warning without touching .env.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Serious
runs an encoded payload.
OBFUSCATION_RUNS_ENCODED_PAYLOAD
scripts/batch-easy-apply.js, line 124
evalJS(`(function(){var all=document.querySelectorAll('div,section,form');for(var i=0;i<all.length;i++){if(all[i].textContent.includes('Apply to')&&all[i].offsetHeight>100){var inp
scripts/batch-easy-apply.js, line 129
evalJS(`(function(){var all=document.querySelectorAll('div,section,form');for(var i=0;i<all.length;i++){if(all[i].textContent.includes('Apply to')&&all[i].offsetHeight>100){var rad
scripts/easy-apply-one.js, line 31
const raw = browser(`eval "eval(atob(\\"${b64}\\"))"`, timeout);
Show more
scripts/search-apply.js, line 190
evalJS(`(function(){var all=document.querySelectorAll('div,section,form');for(var i=0;i<all.length;i++){if(all[i].textContent.includes('Apply to')&&all[i].offsetHeight>100){var inp
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 290d466430ee. can delete files. can reach a host that is not written as a fixed address. can reach mail.google.com. The description does not name that host. can reach cognito-idp.. The description does not name that host. can reach api.groq.com. The description does not name that host. can reach docs.google.com. The description does not name that host. reads a credential or environment file. runs an encoded payload.
Date and source
Date checked:
github.com
Commit graded: 290d466430eeca48400046d827682db1176dc750
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.