job-scraper — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited job-scraper (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This file is the Plane 1 knowledge anchor for the job search workflow (ARCH-0008, ARCH-0010). As a Plane 1 skill it lives under .claude/skills/job-scraper/ and provides the AI assistant with structured knowledge — it does not execute binaries or scrape via compiled code. The skill queries whatever job portals the user has configured, deduplicates results, performs a lightweight fit assessment, and presents new matches sorted by relevance. It covers REQ-1001 through REQ-1012.
The search core is country-agnostic (DEC-012, ADR-0004, NFR-0007): web search is the universal mechanism. No portal, country, locale, or site: string is hardcoded here — every target comes from the companion search-queries.md config. Pasted postings are a first-class input, never a fallback (DEC-011). The skill never fabricates postings (REQ-1012, ARCH-0007).
/search (optionally with a focus area, e.g. /search data science)/scrape| File | When to Read |
|---|---|
search-queries.md (this skill's folder) | Always — the query strategy, portals, geography, and location-filter tiers come from here (data-req §17) |
job_scraper/seen_jobs.json | Always — the deduplication registry (data-req §10); create {"seen": {}} if missing |
job_search_tracker.csv (repo root) | Always — extract already-applied company+role pairs for dedup (REQ-1002) |
01-candidate-profile.md (job-application-assistant skill) | When forming the quick-fit signal — to know the user's core skills |
This skill never modifies search-queries.md; it only reads it.
/search, no argument): run the top 3 priority categories (Priority 1–3) from search-queries.md./search data science): prioritize the query categories that match the focus term, then fill with the highest-priority remaining categories./search broad): run all query categories (Priority 1–4).Before searching, load all three sources:
job_scraper/seen_jobs.json — the seen registry. If the file is missing, create it with exactly {"seen": {}} (data-req §10).job_search_tracker.csv (repo root) — extract the set of already-applied company + role pairs.search-queries.md — the query strategy: Search Sites, Date Filter Rule, Priority 1–4 query groups, and Location Filter Tiers.If search-queries.md still contains [UPPER_SNAKE_CASE] placeholder tokens, the profile has not been set up — tell the user to run /setup --section search rather than searching against template text.
WebSearch queries by combining the user's configured portals (Search Sites) × query strings (selected priority groups) × geography (from the queries / location tiers).site: targeting, portal names, and country/region terms come verbatim from the user's config — never write a literal portal name or site: string into this skill. If the user configured site:<portal> entries, use them as-is; if they listed bare portal names, fold them into the query text.If a configured portal has an adapter (ADR-0004) exposing a deterministic list() pass, prefer it: it returns structured postings (title, company, location, URL, date) without spending tokens, pre-filtering candidates before any LLM work. Feed its results into the same dedup + quick-fit steps below. Adapters are optional — when none exists, web search (above) is the universal fallback (ARCH-0005). Prefer the cheap deterministic pass over LLM calls for the listing stage wherever available (cost-aware search, NFR-0021).
WebFetch the promising ones."I couldn't fetch that posting. Paste it here and I'll use that."
Pasted postings are processed identically to fetched ones (DEC-011) — paste is first-class input.
Assign each new job a lightweight three-level signal used only for sorting:
This is explicitly NOT the full 5-dimension evaluation and NOT a numeric score — it is a sorting signal only. The full evaluation happens later in /apply.
Alongside the fit signal, run a cheap legitimacy scan of each posting's title and snippet against the high-severity signals in trust-safety/scam-patterns.json (upfront fees, personal-data/ID/banking harvesting, off-platform redirects, money-movement, offer without process). If a strong signal appears, mark the job ⚠ Suspicious in the results so the user sees it before investing in /apply. This is a heuristic flag only — the full legitimacy gate runs in /apply (REQ-8001). Never auto-skip a flagged job (ARCH-0006); never invent a flag without the matching text (ARCH-0007).
seen_jobs.json, or if its company+role pair already appears in job_search_tracker.csv.seen_jobs.json under the key <url_or_company_title_key> (the posting URL, or a company+title combination when no stable URL exists). Each entry has exactly these fields: { "seen": { "<url_or_company_title_key>": { "title": "...", "company": "...", "url": "...", "first_seen": "YYYY-MM-DD", "fit": "high|medium|low", "status": "new|skipped|evaluated" } } }status is new for a freshly surfaced match, skipped for a deduplicated/filtered-out job, evaluated once it has been handed to /apply.first_seen is the ISO-8601 date the job was first recorded; do not overwrite it on later runs.Apply the Location Filter Tiers from search-queries.md:
Date rules:
Sort by fit (high → medium → low). Present:
"Want me to evaluate any of these in detail? Just give me the number(s)."
status as evaluated in seen_jobs.json — the dedup registry must stay in sync with downstream handoffs.job_search_tracker.csv.If the AI provider rate-limits, errors, or becomes unavailable mid-search, stop gracefully with a clear message and whatever partial results exist — never retry-spam or spin. Keep parallelism modest; do not run high-volume headless batches that can trip provider abuse heuristics (ARCH-0005).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.