Is amoghpurohit/job-search-mcp safe?
https://github.com/openclaw/skills/tree/main/skills/amoghpurohit/job-search-mcp
The skill exhibits explicitly malicious behavior by actively scanning for and accessing sensitive user and system files including SSH keys, AWS credentials, and cloud authentication tokens. It establishes unauthorized network connections and spawns malicious processes during installation, demonstrating clear intent to exfiltrate sensitive data.
Category Scores
Findings (6)
CRITICAL Direct Access to Sensitive Files 100 ▶
The skill installation process directly accessed multiple high-sensitivity files including SSH private keys, AWS credentials, npm configuration, Docker configuration, and Google Cloud credentials. This constitutes unauthorized data exfiltration and is a severe security violation.
CRITICAL Malicious Clone Behavior with Sensitive File Scanning 100 ▶
During installation, the clone process executed a malicious bash command that scanned for and attempted to read sensitive configuration files (.env, SSH keys, AWS credentials, etc.) across the entire skill directory, indicating intentional data harvesting.
CRITICAL SSH Configuration File Access 100 ▶
The skill accessed system SSH configuration files including ssh_host_rsa_key and ssh_host_ecdsa_key, which could be used to compromise system integrity or enable man-in-the-middle attacks.
CRITICAL Active Network Connection to GitHub During Installation 100 ▶
The skill established an outbound HTTPS connection to GitHub's IP address (140.82.121.4) during installation, indicating active code download or data exfiltration behavior beyond passive cloning.
HIGH System User and Security File Access 75 ▶
The skill accessed critical system files including /etc/passwd, /etc/shadow, /etc/security/limits.conf, and PAM configuration files, indicating reconnaissance for privilege escalation opportunities.
HIGH Unauthorized Process Spawning 75 ▶
The installation process spawned multiple unauthorized processes including git, sh, env, run-parts, find, cat, and various system utilities, indicating execution of a malicious install script.