Claude Code, Plugin
jobpilot
Automated job-hunt pipeline for Claude Code — scrapes ~10 job boards via Apify, scores postings against your resume, tailors resumes, and pushes a Telegram digest on a schedule.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit fa6b5c1b43a8, unchanged since the check below.
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
core/backends.py, line 62
return subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, - INSTALL_UNPINNED Low
Dependencies use a range or git URL with no lockfile.
requirements.txt, line 1
apify-client>=1.8 - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
core/backends.py, line 172
resp = httpx.post( - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
core/backends.py, line 172
resp = httpx.post( - SECRETS_PATH_DOTENV Low
Mentions a .env file.
core/secrets.py, line 6
Nothing here is written to the OS keyring or `.env` any more - that path only remains - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
core/crypto.py, line 38
env_key = os.environ.get("JOBPILOT_MASTER_KEY")
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
core/backends.py, line 62
return subprocess.run(cmd, capture_output=True, text=True, timeout=timeout,
core/tailoring.py, line 148
proc = subprocess.run(
core/infra/docker.py, line 62
return subprocess.run(["docker", *args], capture_output=True, text=True, timeout=timeout)
Show more
core/repo/tailored.py, line 154
shutil.rmtree(folder, ignore_errors=True)
engines/claude_code.py, line 79
out = subprocess.run([self.cli, "--version"], capture_output=True,
jobpilot/cli.py, line 293
code = subprocess.call(cmd)
jobpilot/cli.py, line 323
return subprocess.call([sys.executable, "-m", "server"],
jobpilot/cli.py, line 401
proc = subprocess.Popen(
orchestrator/artifacts.py, line 135
shutil.rmtree(self.dir, ignore_errors=True)
scripts/jobpilot_clear.py, line 59
shutil.rmtree(f, ignore_errors=True)
scripts/jobpilot_setup.py, line 109
subprocess.run([sys.executable, "-m", "pip", "install", "-r", str(req)], check=True)
Install and update
Concern
dependencies are not pinned.
INSTALL_UNPINNED
requirements.txt, line 1
apify-client>=1.8
Network
Concern
can reach a host that is not written as a fixed address. can reach api.apify.com. The description does not name that host. can reach api.adzuna.com. The description does not name that host. can reach api.telegram.org. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
core/backends.py, line 172
resp = httpx.post(
core/backends.py, line 431
script = httpx.get(TECTONIC_DROP_URL, timeout=30,
jobpilot/cli.py, line 182
data = httpx.get(PYPI_JSON, timeout=timeout).raise_for_status().json()
Show more
scripts/apify_scraper.py, line 233
search = requests.get(
scripts/apify_scraper.py, line 255
thread = requests.get(
scripts/apify_scraper.py, line 329
r = requests.get(f"{APIFY_BASE}/users/me", params={"token": token}, timeout=8)
scripts/apify_scraper.py, line 555
resp = requests.post(url, params={"token": token}, json=run_input, timeout=timeout)
scripts/apify_scraper.py, line 643
lambda: ats_boards.fetch(keywords, max_results=100, focus=focus))
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
core/crypto.py, line 38
env_key = os.environ.get("JOBPILOT_MASTER_KEY")
core/secrets.py, line 6
Nothing here is written to the OS keyring or `.env` any more - that path only remains
scripts/jp_secrets.py, line 10
2. .env file (via python-dotenv) - first the data-dir .env, then a repo-local .env
Show more
scripts/jp_secrets.py, line 57
_jobpilot_dir() / ".env",
scripts/jp_secrets.py, line 58
Path(__file__).resolve().parent.parent / ".env",
scripts/jp_secrets.py, line 72
environment variables (populated from .env).
scripts/jp_secrets.py, line 91
# 2) environment / .env
scripts/jp_secrets.py, line 98
f"(service '{KEYRING_SERVICE}') or in {_jobpilot_dir() / '.env'}."
scripts/jp_secrets.py, line 133
env_path = _jobpilot_dir() / ".env"
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit fa6b5c1b43a8. can delete files. dependencies are not pinned. can reach a host that is not written as a fixed address. can reach api.apify.com. The description does not name that host. can reach api.adzuna.com. The description does not name that host. can reach api.telegram.org. The description does not name that host. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: fa6b5c1b43a829196f27734b86d4814ae2cf811e
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.