openjobs@ 3.12.0
https://clawhub.ai/api/v1/skills/openjobs/file?path=SKILL.md&version=3.12.0
github.com/clawhub.ai/openjobs
Scanned Thu, 28 May 2026 16:44:18 GMT
Scan ID crawl-wt6f26eb29vhmmuz9l078i72 · 15ms
C
SCORE 55 / 100
Verdict: Proceed with caution

9 medium findings.

This skill spawns subprocesses outside its declared capabilities plus 8 other issues listed below.

0 critical0 high9 medium3 rules passed

Why grade C?

score · 55 / 100

The current grade reflects 9 medium findings (6+ MEDs → C).

0 CRIT0 HIGH9 MED0 LOW
To reach a higher grade
  • B
    Reach Btarget score 75

    Resolve 4 of 9 MED (cap is 5).

  • A
    Reach Atarget score 95

    Resolve 7 of 9 MED (cap is 2).

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Findings · ordered by severity

med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 140CWE-78
▾
138import path from "path";
139import os from "os";
140import { execSync } from "child_process";← spawns a subprocess outside declared capabilities
141
142const WALLET_DIR = path.join(os.homedir(), ".openjobs", "wallet");
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 149CWE-78
▾
147 if (process.platform === "darwin") {
148 try {
149 const pw = execSync(← spawns a subprocess outside declared capabilities
150 'security find-generic-password -s openjobs-wallet -w 2>/dev/null',
151 { encoding: "utf8" }
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 159CWE-78
▾
157 if (process.platform === "linux") {
158 try {
159 const pw = execSync(← spawns a subprocess outside declared capabilities
160 'secret-tool lookup application openjobs 2>/dev/null',
161 { encoding: "utf8" }
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 175CWE-78
▾
173 if (process.platform === "darwin") {
174 try {
175 execSync(← spawns a subprocess outside declared capabilities
176 `security add-generic-password -s openjobs-wallet -a openjobs -w "${generated}"`,
177 { stdio: "ignore" }
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 184CWE-78
▾
182 if (process.platform === "linux") {
183 try {
184 execSync(← spawns a subprocess outside declared capabilities
185 `echo -n "${generated}" | secret-tool store --label="OpenJobs Wallet" application openjobs`,
186 { stdio: "ignore" }
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 241CWE-78
▾
239import path from "path";
240import os from "os";
241import { execSync } from "child_process";← spawns a subprocess outside declared capabilities
242
243const WALLET_FILE = path.join(os.homedir(), ".openjobs", "wallet", "wallet.json");
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 249CWE-78
▾
247 if (process.platform === "darwin") {
248 try {
249 const pw = execSync(← spawns a subprocess outside declared capabilities
250 'security find-generic-password -s openjobs-wallet -w 2>/dev/null',
251 { encoding: "utf8" }
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 258CWE-78
▾
256 if (process.platform === "linux") {
257 try {
258 const pw = execSync(← spawns a subprocess outside declared capabilities
259 'secret-tool lookup application openjobs 2>/dev/null',
260 { encoding: "utf8" }
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
Scan another →Share
skillox.io/r/crawl-wt6f26eb29vhmmuz9l078i72