by 安全扫描
OpenClaw
可疑
medium confidenceThe skill mostly matches its stated purpose (batch resume ↔ JD matching) but contains several inconsistencies and risky items (embedded API credentials in config, broken/mismatched import paths, and the ability to send full resume text to external APIs) that warrant caution before installing or running.
评估建议
This skill appears to implement resume↔JD matching, but proceed cautiously. Key concerns: 1) The repo includes hard-coded API keys and bearer tokens in references/config_resume_match.yaml — treat these as insecure and remove them before use; do NOT assume they are safe or your own. 2) If you enable 'api' mode (or if the skill falls back to the included config), the skill will send full resume text (sensitive personal data) to external third-party endpoints — verify which endpoint and credential ...详细分析 ▾
ℹ 用途与能力
Name/description (resume ↔ JD matching) aligns with the code: scripts parse .docx/.pdf, create tasks, call subagents or external APIs, and produce Excel output. However there are mismatches: main.py dynamically imports a file at C:\Users\Administrator\.openclaw\workspace\resume_match_v2.0.2.py which is not present in the package (the repo has scripts/resume_match.py). Config/example files use different default paths (D:\ vs C:\) across SKILL.md, README, and _meta.json. These inconsistent paths/import targets make runtime behavior unclear and could cause failures or unexpected fallbacks.
⚠ 指令范围
SKILL.md and code intentionally read local resume/JD files and write outputs including parsed JSON copies of each resume into a parsed/ folder — expected for the feature but means full resume text is persisted to disk. In 'api' mode the skill will send entire resume text to configured external endpoints. The SKILL.md claims subagent mode needs no API keys, but the code and config support an 'api' mode that will transmit potentially sensitive resume content to third‑party APIs. The instructions and code do not request unrelated system files, but they do write parsed personal data to disk and may call external services if API mode is enabled.
✓ 安装机制
There is no separate install spec or remote download — risk from installation mechanism is low. The skill is provided as code files (no arbitrary archive downloads).
⚠ 凭证需求
Registry metadata declares no required environment variables or primary credential, but the included references/config_resume_match.yaml contains multiple hard-coded API keys and bearer tokens for various providers (e.g., entries under 'api_providers' with api_key values). Embedding third‑party API keys in the repository is a red flag: (1) those keys may be stale/leaked credentials belonging to someone else, (2) the skill can be switched into 'api' mode and will send full resume contents to external endpoints using those credentials. The skill's declared permissions (sessions_spawn, subagents, sessions_history) are appropriate for subagent operation, but the presence of embedded secrets is disproportionate to the stated 'no env needed' claim and increases data‑exfiltration risk.
✓ 持久化与权限
always is false and the skill does not request permanent platform-wide privileges. It does require OpenClaw subagent-related permissions (sessions_spawn, subagents, sessions_history) which are consistent with its design to spawn child agents. The skill does not appear to modify other skills or system-wide settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv2.0.32026/4/3
Resume-JD-Matcher 2.0.3: Major upgrade with dual-mode support and efficiency improvements - Added dual working modes: "subagent" (for OpenClaw) and "api" (standalone script with AI API). - Now supports batch parsing of resumes and job descriptions, with AI-powered structure matching and Excel report generation. - Improved performance: supports concurrent processing, configurable parallelism (default 3), and incremental processing (skip already-matched resumes). - Enhanced configuration flexibility: detailed YAML-based setup for paths, API, logging, and advanced parameters. - Output now includes structured Excel reports with both detailed analysis and summary sheets. - Updated documentation with workflows, directory structure requirements, mode comparison, troubleshooting, and dependency lists.
● 可疑
安装命令
点击复制官方npx clawhub@latest install resume-jd-matcher
镜像加速npx clawhub@latest install resume-jd-matcher --registry https://cn.longxiaskill.com镜像同步中