Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add suxrobGM/jobpilot --skill applygit clone --depth 1 https://github.com/suxrobGM/jobpilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/suxrobgm/jobpilot/apply)<a href="https://agentmods.dev/skills/suxrobgm/jobpilot/apply"><img src="https://agentmods.dev/badge/skills/suxrobgm/jobpilot/apply/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/suxrobgm/jobpilot/apply"><img src="https://agentmods.dev/badge/skills/suxrobgm/jobpilot/apply.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 6 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Prompt Injection · line 24 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Data Exfiltration · line 75 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 86 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 124 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 194 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 236 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.03007 |
| Opus 5.5 | $0.00014 | $0.01203 |
| Sonnet 5.5 | $0.00007 | $0.00601 |
| Haiku 4.5 | $0.00003 | $0.00301 |
Grade A, and why
apply scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 21d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 272 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Apply - Single Job or Pasted Links
Two modes, one shared apply loop:
- Single-job (argument is a URL or pasted job page): fit review → user "yes" → apply one.
- Batch (no argument, or a campaign that still holds
queuedlinks): score the campaign'squeuedrows → ranked table approval → apply all.
User approves once up front. No per-job confirmation after that.
Setup
Follow ../_shared/setup.md to load profile, resume, credentials. Shared campaign mechanics
(applied-check, result writes, worker input, rules) live in ../_shared/campaign-flow.md.
Read autoApply for config (defaults applied per field):
| Setting | Default | Notes |
|---|---|---|
minMatchScore |
60 | Batch-mode threshold (0-100); the campaign's config.minScore wins when set. Ignored in single-job mode. |
maxApplicationsPerCampaign |
null (unlimited) |
Sent as config.maxApplications when set; omit for unlimited batch. Single-job mode forces 1. |
defaultStartDate |
"2 weeks notice" |
Default start-date answer. |
For ATS portals (Greenhouse, Lever, Workday, etc.) the apply step lands on a domain that isn't in
/api/job-boards; the job-applier handles login/registration there per ../_shared/auth.md.
Phase 0: Dispatch
- Argument is
campaign <campaign-id>→ setCAMPAIGN_ID=<campaign-id>and fetch it first (GET /api/campaigns/$CAMPAIGN_ID); the summary decides which of the two branches runs:summary.byStatus.queued > 0→ the campaign still holds pasted links nobody has visited: go to Phase 2, skipping 2.1 (the campaign is already resolved).- otherwise → re-apply mode: set
config.maxApplications = null(unlimited - the user hand-selected these jobs), skip Phases 1-4, and run the Phase 5 loop over its currentapprovedjobs. (The campaign viewer - or therescan-skippedskill - promotes the chosen skipped/failed jobs toapprovedbefore injecting this.)
- Any other argument present → Phase 1 (single-job).
- No argument → Phase 2 (batch).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 21d ago Changed · +30 lines 5d924f248c31
- 26d ago Changed · -6 lines 826af4d00e0e
- 1mo ago First seen · 248 lines · 35 tokens per session scan A 7f720d82712b
apply is a skill published in the GitHub repository suxrobGM/jobpilot (101 stars, last pushed 19d ago), licensed MIT. It adds 35 tokens to every session and 3,007 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Cover Letter Generator
Create personalized, compelling cover letters from resume and job description.
resume-tailoring
Methodology for tailoring a resume to a job description honestly and effectively — fit analysis, gap handling, keyword mirroring, fast-learner framing, and primary-over-secondary emphasis. Use whenever curating or rewriting a resume for a specific role.
add-vacancy
Use whenever the user wants to ingest one or more job vacancies into Job Search HQ. Triggers: /add-vacancy, "add this vacancy", "add these jobs", pasting one or more job URLs, or pasting an aggregator/search URL and asking to expand it. Handles a single URL, a bulk list, or an aggregator page (DOU / Djinni /…
interview-prep
Use when the user wants to prepare for an interview tracked in Job Search HQ. Triggers: /interview-prep, "prep me for the X interview", "interview prep for ", "help me get ready for my final round", or accepting the prompt offered by /update-status when an interview is scheduled. Researches the company live and builds…
ingest-cv
Use when the user wants to import a CV/résumé into Job Search HQ so it can drive scoring and CV-tailoring. Triggers: /ingest-cv, "ingest my CV", "parse my resume", "import my CV", "read my CV in profile/cv". Parses PDF/DOCX/Markdown CV files in profile/cv/ (gitignored) into structured CV data linked from…
add-teams
Adds Microsoft Teams connector to a Power Apps code app. Use when sending Teams messages, posting to channels, or integrating with Teams chat.