Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/suxrobGM/jobpilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/plugins/suxrobgm/jobpilot/plugin)<a href="https://agentmods.dev/plugins/suxrobgm/jobpilot/plugin"><img src="https://agentmods.dev/badge/plugins/suxrobgm/jobpilot/plugin/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/plugins/suxrobgm/jobpilot/plugin"><img src="https://agentmods.dev/badge/plugins/suxrobgm/jobpilot/plugin.svg" alt="Reviewed on agentmods" width="80" height="20"></a>Grade A, and why
jobpilot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{
"name": "jobpilot",
"description": "Claude Code skills and Playwright MCP wiring for JobPilot job applications.",
"version": "2.2.1",
"author": {
"name": "JobPilot"
}
}
What it installs
The manifest is a name and a version. 22 skills, 4 agents, 2 MCP servers travel with it, and installing the plugin installs all of them — 1,100 tokens a session between them. Each is measured on its own page, and each can be installed alone.
- Skill tailor-resume A 27 tokens
- Skill apply A 35 tokens
- Skill auto-apply A 34 tokens
- Skill extract-resume A 32 tokens
- Skill networking A 37 tokens
- Skill upwork-search A 40 tokens
- Skill scan-inbox A 34 tokens
- Skill search A 32 tokens
- Skill upwork-profile A 50 tokens
- Skill cover-letter A 35 tokens
- Skill rescan-skipped A 49 tokens
- Skill resume-campaign A 40 tokens
- Skill review-resume A 28 tokens
- Skill upwork-proposal A 33 tokens
- Skill upwork-submit A 34 tokens
- Skill get-code A 38 tokens
- Skill interview A 29 tokens
- Skill solve-captcha A 40 tokens
- Skill upwork-sync A 35 tokens
- Skill pilot A 38 tokens
- Skill setup C 36 tokens
- Skill humanizer A 54 tokens
- Agent job-applier A 73 tokens
- Agent job-scorer A 77 tokens
- Agent job-searcher A 67 tokens
- Agent networking-worker A 73 tokens
- MCP server playwright A not measured
- MCP server upwork A not measured
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago Changed e39f0a68b5c2
- 13d ago Changed 53e039d5441b
- 1mo ago Changed bec5c8f996d1
- 1mo ago Changed 65ca230a5824
- 1mo ago Changed 522303a807f8
- 1mo ago First seen · 9 lines scan A db085a006f88
jobpilot is a plugin published in the GitHub repository suxrobGM/jobpilot (94 stars, last pushed 11d ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other plugins, from other repositories
Resume-Builder
AI-powered resume builder with job discovery, dual ATS + HR scoring, and cover letter generation. Finds and ranks live job listings by fit, tailors your resume to any JD, auto-detects 6+ professional domains, and produces Workday-compatible DOCX output.
webshare
Official Webshare proxy skills: manage proxies with the webshare CLI, optimize a pool for a target site, build Playwright scrapers, and audit proxy spend.
dear-hiring-manager
Assisted job-application filler. Extracts the JD, scores fit, fills every form field from your profile and answer memory, and stops before Submit for your review. Runs interactively in Claude Code.
give-me-job
Korea-only job application agent skills. Turns resume.md, a Korean job post, and optional company context into an evidence-grounded application package. Never submits, logs in, or transmits personal information.
daily-working
End-to-end pipeline: pull a task from the project's task tracker (Redmine today) by ID, implement it with the Claude CLI, verify the result in a real browser via the claude-in-chrome extension, and keep the tracker ticket in sync throughout.
electron-playwright-validator
Electron app UI automation and validation via Playwright CDP.