career-ops: why it is not safe to use
career-ops is largely local-first, but it did not fully pass because it performs external update checks and offers opt-in plugins with sensitive account access.
What we found
Our review did not find signs of hidden prompt injection, hardcoded secrets, dangerous auto-actions, obfuscated code, or privilege escalation in the inspected materials. The repository describes the tool as local-first and draft-only, and says it does not send, submit, or click on a user's behalf.
The main reasons this skill did not fully pass are narrower. First, it checks GitHub for updates at the start of each session. Second, its optional plugin system can fetch approved or community plugin code at pinned commits. Both behaviors are disclosed, but they still introduce external network activity and software supply chain considerations.
We also found that optional plugins can connect to sensitive services such as Gmail, Google Calendar, and Outlook using user-provided credentials. This is documented and opt-in, but it can expand the skill's access to personal or work data.
What to do instead
Use the core local drafting features without enabling plugins if you want the smallest exposure. If you do enable plugins, review which services they access, use only the ones you need, and connect them only with clear user consent. For higher-sensitivity use, prefer setups that avoid external update checks and limit account-linked integrations.
Source: https://github.com/santifer/career-ops
We report what our security review found at the time we checked, with the goal of keeping people safe. Projects change; if a maintainer has since fixed this, we are glad to recheck it. Email hello@agentpod.com.