Is aiApply : Cover Letter Generator safe?
aiApply copies job application inputs and generated AI output into Alibaba Cloud log events.
When you generate a cover letter from text or a URL, aiApply logs the submitted text, URL, page content, request data, and AI response data. Its logger adds identifiers and environment details such as UUID, install time, browser, language, user agent, and stored user email before sending the events to Alibaba Cloud.
Who publishes itradarlinkedin - 2 other listings from the same operator, none carrying a finding
radarlinkedin - 2 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 2k+ users between them, none of them carrying a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Job inputs and AI output are copied into Alibaba Cloud logs
Using aiApply to generate job-application text sends the text/URL you provided, the generated response, and account/device context to an Alibaba Cloud endpoint at extension-us.us-west-1.log.aliyuncs.com/logstores/scrm-ai-apply/track.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
The user enters application text or a job URL and starts generation.
The extension copies job inputs, request data, generated output, and account/device context into Alibaba Cloud log events.
- Job URLhttps://example.com/jobs/12345 (illustrative)
Identifies the job posting or recruiting page used for generation.
- Application textCover letter draft for a sales role (illustrative)
Contains text you typed or generated for a job application.
- Stored account and device contextuser@example.com with browser and version details (illustrative)
Links the event to extension installation, browser, language, user-agent, UUID, and user-email context.
What it can do
Permissions this extension asks for, as declared in version 2.0.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on linkedin.com
*://*.linkedin.com/*
Read and change your data on supawork.ai
*://*.supawork.ai/*
Read and change your data on indeed.com
*://*.indeed.com/*
Store data in your browser
storage
Where it sends data
Destinations our analysis observed aiApply : Cover Letter Generator contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- extension-us.us-west-1.log.aliyuncs.comwidely used
aiApply : Cover Letter Generator sends data to extension-us.us-west-1.log.aliyuncs.com. A widely used service: 27 other extensions we have analysed send data here.