resume-jd-matcher — 简历JD智能匹配

v2.0.3

批量读取简历与岗位JD，调用AI模型自动打分并输出Excel结构化匹配报告，一键完成招聘初筛。

0· 95·0 当前·0 累计

by @sxffly·MIT

电商工具 AI模型访问

使用场景：京东商品搜索京东API调用

下载技能包

License

MIT

最后更新

2026/4/3

安全扫描

VirusTotal

可疑

查看报告

OpenClaw

可疑

medium confidence

The skill mostly matches its stated purpose (batch resume ↔ JD matching) but contains several inconsistencies and risky items (embedded API credentials in config, broken/mismatched import paths, and the ability to send full resume text to external APIs) that warrant caution before installing or running.

评估建议

This skill appears to implement resume↔JD matching, but proceed cautiously. Key concerns: 1) The repo includes hard-coded API keys and bearer tokens in references/config_resume_match.yaml — treat these as insecure and remove them before use; do NOT assume they are safe or your own. 2) If you enable 'api' mode (or if the skill falls back to the included config), the skill will send full resume text (sensitive personal data) to external third-party endpoints — verify which endpoint and credential ...

详细分析 ▾

ℹ 用途与能力

Name/description (resume ↔ JD matching) aligns with the code: scripts parse .docx/.pdf, create tasks, call subagents or external APIs, and produce Excel output. However there are mismatches: main.py dynamically imports a file at C:\Users\Administrator\.openclaw\workspace\resume_match_v2.0.2.py which is not present in the package (the repo has scripts/resume_match.py). Config/example files use different default paths (D:\ vs C:\) across SKILL.md, README, and _meta.json. These inconsistent paths/import targets make runtime behavior unclear and could cause failures or unexpected fallbacks.

⚠ 指令范围

SKILL.md and code intentionally read local resume/JD files and write outputs including parsed JSON copies of each resume into a parsed/ folder — expected for the feature but means full resume text is persisted to disk. In 'api' mode the skill will send entire resume text to configured external endpoints. The SKILL.md claims subagent mode needs no API keys, but the code and config support an 'api' mode that will transmit potentially sensitive resume content to third‑party APIs. The instructions and code do not request unrelated system files, but they do write parsed personal data to disk and may call external services if API mode is enabled.

✓ 安装机制

There is no separate install spec or remote download — risk from installation mechanism is low. The skill is provided as code files (no arbitrary archive downloads).

⚠ 凭证需求

Registry metadata declares no required environment variables or primary credential, but the included references/config_resume_match.yaml contains multiple hard-coded API keys and bearer tokens for various providers (e.g., entries under 'api_providers' with api_key values). Embedding third‑party API keys in the repository is a red flag: (1) those keys may be stale/leaked credentials belonging to someone else, (2) the skill can be switched into 'api' mode and will send full resume contents to external endpoints using those credentials. The skill's declared permissions (sessions_spawn, subagents, sessions_history) are appropriate for subagent operation, but the presence of embedded secrets is disproportionate to the stated 'no env needed' claim and increases data‑exfiltration risk.

✓ 持久化与权限

always is false and the skill does not request permanent platform-wide privileges. It does require OpenClaw subagent-related permissions (sessions_spawn, subagents, sessions_history) which are consistent with its design to spawn child agents. The skill does not appear to modify other skills or system-wide settings.

安全有层次，运行前请审查代码。

License

MIT

查看条款 ↗

运行时依赖

无特殊依赖

版本

latestv2.0.32026/4/3

Resume-JD-Matcher 2.0.3: Major upgrade with dual-mode support and efficiency improvements - Added dual working modes: "subagent" (for OpenClaw) and "api" (standalone script with AI API). - Now supports batch parsing of resumes and job descriptions, with AI-powered structure matching and Excel report generation. - Improved performance: supports concurrent processing, configurable parallelism (default 3), and incremental processing (skip already-matched resumes). - Enhanced configuration flexibility: detailed YAML-based setup for paths, API, logging, and advanced parameters. - Output now includes structured Excel reports with both detailed analysis and summary sheets. - Updated documentation with workflows, directory structure requirements, mode comparison, troubleshooting, and dependency lists.

● 可疑

安装命令

点击复制

官方npx clawhub@latest install resume-jd-matcher

镜像加速npx clawhub@latest install resume-jd-matcher --registry https://cn.longxiaskill.com 镜像可用

本土化适配说明

resume-jd-matcher — 简历JD智能匹配安装说明：安装命令：npx clawhub@latest install resume-jd-matcher 该技能用于京东相关操作，可能需要相应的平台账号或API密钥

需要定制？告诉我你的需求 →

License

运行时依赖

版本

安装命令

本土化适配说明

相关技能推荐