Placed Job Tracker

This skill should be used when the user wants to "track job applications", "add a job application", "update application status", "view my job pipeline", "get...

This skill appears to do what it says (call the Placed API) but take these precautions before installing/using it: 1) Confirm you trust https://placed.exidian.tech and obtain the API key from your account settings there. 2) Prefer providing the key via an environment variable rather than having the skill write a plaintext file; if you must store it, inspect the saved file to ensure it contains only an export line and set file permissions (chmod 600). 3) Be aware that the skill will source ~/.config/placed/credentials on startup — if that file is tampered with it could execute arbitrary shell commands. 4) Ask the publisher to update registry metadata to declare PLACED_API_KEY as a required credential and to offer a secure storage recommendation (or use a secrets manager). 5) If you have sensitive host-level threat concerns, avoid persisting the key and instead provide it for the session only.

Type: OpenClaw Skill Name: placed-job-tracker Version: 1.0.1 The skill contains a shell injection vulnerability in the `placed_call` function defined in `SKILL.md`. The function insecurely embeds the `$args` variable directly into a `curl` command string, which could allow for arbitrary command execution if the agent is provided with malicious input. While the skill's stated purpose of tracking job applications via `https://placed.exidian.tech` appears legitimate, the lack of input sanitization in the shell-based API caller poses a significant security risk.