career-ops agent skills
A local job search agent for Claude Code, Codex and other CLIs: scans job boards, scores listings against your CV, tailors resumes and tracks applications.
with caveats
Well maintained and far deeper than a prompt, but it is a full local application with setup, API keys and possible per-token billing, not a skill you just drop in.
check first: needs an API key · makes network calls → security details
- Depth
- 4/5
- Last update
- today
- Installs
- —
- Stars
- 79K
- Forks
- 15K
- License
- MIT
What career-ops does
career-ops turns a coding agent into a job search assistant that runs from a local checkout of the repo. The main career-ops skill is a 21 KB router. You call it with a mode, and it finds the project root (the directory holding AGENTS.md and modes/) and a separate data root for your own files, then loads the matching mode. The modes cover the whole search. scan and discover pull listings from ATS job boards listed in portals.yml. The evaluation modes check whether a posting is still open and score it 1 to 5 against your CV. pdf, latex and ats produce a tailored resume, and cover and email draft letters and outreach. tracker and pipeline keep an application log in the gitignored data/ folder, while interview-prep, offer-prep and followup handle the later stages. node scan.mjs --verify runs zero-token discovery plus a Playwright liveness check. Optional plugins add Apify scraping, Gmail and Notion integrations, and an H1B sponsor lookup with its own scripts. The other skill folders (.claude, .opencode, .grok, .qwen and others) only point back to the same SKILL.md. The tool fills in each application, and you press Submit yourself.
Good for
- Job seekers comfortable running a Node project from a terminal
- Filtering a large number of listings before deciding where to apply
- Tailoring a CV and cover letter per role while keeping a local tracker
- Running on free or local models via OpenRouter or Ollama
Not for
- People who want a drop-in skill without cloning and configuring a repo
- Anyone expecting automatic application submission
- Users who don't want their CV sent to any AI provider
What's inside depth 4/5
One 21 KB router skill backed by a modes/ directory, Node scripts such as scan.mjs and path-resolver.mjs, four plugins with their own scripts, 21 eval files and CI; the other skill folders are links to the same file.
- Skills
- 15
- Reference docs
- 1
- Scripts
- 15
- Tests / evals
- 21
- Templates
- 0
- Avg SKILL.md
- 8.1 KB
Counted from the repository file tree. How we score depth.
Dependencies and costs
- Node.js and a local clone of the repo (the skill needs AGENTS.md and modes/ next to it)
- Playwright for the liveness check in scan.mjs
- An AI provider: a CLI subscription, an API key such as GEMINI_API_KEY, or a local/OpenRouter model
- Optional: APIFY_TOKEN for the Apify plugin, Google OAuth credentials for the Gmail plugin, a Notion integration for the Notion plugin
- Telemetry: None found. The README states there is no telemetry and no backend run by the project; your CV goes only to the AI provider you configure.
Security review
Security: Check firstThe skill is a router that needs the full career-ops repo; if that is missing it offers, after asking, to install it with a pinned npx package that downloads the latest release and its dependencies. Optional plugins can read a Gmail label with your OAuth credentials, run Apify actors with your Apify token, and query an H-1B endpoint only if you configure one; the H-1B lookup uses a local index by default. Most of the repo (modes, scripts, Notion and some H-1B plugin files) was not in the files reviewed.
Worth knowing
- Needs an API key for its own serviceThe optional Apify provider sends APIFY_TOKEN as a Bearer header only to the hardcoded base https://api.apify.com/v2.plugins/apify/_apify.mjs:20
- Needs an API key for its own serviceThe optional Gmail plugin reads GMAIL_CLIENT_ID/SECRET/REFRESH_TOKEN from .env and sends them only to Google's OAuth and Gmail API endpoints.plugins/gmail/index.mjs:96
- Makes network requestsWhen enabled, the Gmail plugin lists and downloads full messages from a configured label to extract job URLs, which are written to the local pipeline.plugins/gmail/index.mjs:120
- Makes network requestsThe Apify provider starts actor runs, polls them and downloads dataset items from api.apify.com.plugins/apify/_apify.mjs:63
- Makes network requestsThe H-1B check uses a local index by default and only contacts an HTTP endpoint if the user sets H1B_API_BASE.plugins/h1b-sponsor/check.mjs:57
- Relies on a CLI or package we could not reviewWhen career-ops is missing, the skill offers to run
npx @santifer/career-ops@1.38.0 initafter asking, and that package is not in the files reviewed..agents/skills/career-ops/SKILL.md:26 - Installs packages or toolsThe init command downloads the latest career-ops release from GitHub into ./career-ops and installs its dependencies..agents/skills/career-ops/SKILL.md:26
What we checked
The repository (2998 files) on Nov 1, 2026. Not a full review: 2846 of 2998 files were not downloaded (large repository; we reviewed the skill folders); we read 6 of 15 code files; it relies on code outside the repository: npm package @santifer/career-ops (run via `npx @santifer/career-ops@1.38.0 init`); career-ops release downloaded from GitHub by the init step, and its npm dependencies (e.g. js-yaml, playwright); plugins/h1b-sponsor/install-h1b-index.mjs, lib/api.mjs, lib/cache.mjs, lib/clean.mjs, lib/index.mjs, lib/tier.mjs, token.mjs (listed but text not provided).
NVIDIA SkillSpector static scan: 35 pattern hits (Excessive Agency 8, Privilege Escalation 8, Agent Snooping 8, MCP Rug Pull 5, Data Exfiltration 4, Prompt Injection 2). Most hits are README text: codex exec examples, .env setup instructions, and an unpinned npx @santifer/career-ops mention (the SKILL.md itself pins @1.38.0). The 'external transmission' and 'access token' hits are the optional Apify, Gmail, Notion and H-1B plugins calling their own service APIs with the user's own credentials. The 'skill enumeration' hits are symlinked copies of the same SKILL.md.
A review, not a certification. Skills change after we check them — read the files before installing.
License
MIT, commercial use allowed. The README says the "career-ops" name is covered by a separate trademark notice.
Can it run unattended?
Yes. Scanning, batch and pipeline modes can run headless through codex exec or grok -p, with state kept in files under data/, but writing applications and submitting them stays with you.
FAQ
What is career-ops?
career-ops is an open-source job search agent created by @santifer that runs on your own machine inside an AI coding CLI. It scans job boards, checks whether listings are still open, scores each one 1 to 5 against your CV, tailors a resume and cover letter, and keeps an application tracker. It does not submit applications for you.
How do I install career-ops?
The README describes running it as a Claude Code plugin or from a local checkout in Codex, OpenCode and other CLIs. A typical setup is to clone the repo, copy .env.example to .env, add an API key, and install dependencies. docs/SETUP.md has the full guide, and docs/WINDOWS.md covers Windows-specific issues such as Git Bash discovery, line endings and symlink errors.
Is career-ops safe to use?
We found no hidden network calls or telemetry, and the README says it has no backend of its own. Your CV and job data go to whichever AI provider you choose. The optional Gmail, Apify, Notion and H1B sponsor plugins make their own network requests when you enable them.
Can I run career-ops for free?
The README says it works with free and local models through OpenRouter free models, Ollama or any OpenAI-compatible endpoint, and suggests a free Gemini API key for setup. docs/RUNNING_ON_A_BUDGET.md and docs/FREE_TIER.md cover the details.
Why is career-ops using API credits when I pay for Claude Pro or Max?
According to the README, an ANTHROPIC_API_KEY set in your environment takes precedence over your logged-in subscription, so the CLI bills per token. Run echo $ANTHROPIC_API_KEY and remove the key from your environment if it prints anything.