自动管理简历和求职信模板，记录职位投递及状态，通过 Gmail 自动发送并分类求职邮件。

This skill's functionality (compose and send application emails, manage local records) is coherent, but there are important red flags you should address before installing or using it: - Do not rely on the hard-coded MATON_API_KEY in the script. Treat it as a secret: remove it from code and require the user to provide their own credential (and prefer OAuth for Gmail). If you already used this code with the embedded key, consider revoking that key at the Maton/gateway service. - Verify and understand the third-party gateway (gateway.maton.ai). The script sends email content and attachments through that service; only use it if you trust that provider and their data handling. Prefer using Google's official API and OAuth flows if you want direct Gmail integration. - Fix the configuration inconsistencies: SKILL.md, registry metadata, and the code should agree on what env var is required (e.g., GMAIL_API_KEY or MATON_API_KEY) and declare it in the registry. Avoid shipping default credentials. - Review the code for how attachments are selected (resume path) so you don’t unintentionally send sensitive files. The script reads data/resume.json and local resume file paths — ensure those files contain only information you want transmitted. - If you do not trust the Maton gateway or the embedded key, do not run the send functionality. You can still use the non-network parts locally (cover letter generation, local application tracking) after removing or sandboxing network calls. If you want, I can suggest precise code changes to remove the hard-coded key, add explicit env var checks, or switch the script to use OAuth with Google's official API.

Type: OpenClaw Skill Name: job-hunter-gmail Version: 1.0.0 The skill bundle contains a hardcoded API key for the Maton Gmail gateway in `scripts/send_application.py`, which is a significant security vulnerability. While the script's logic for sending job applications and managing resume data aligns with its stated purpose in `SKILL.md`, the inclusion of a static credential and the use of an external API proxy (`gateway.maton.ai`) warrant a suspicious classification. No evidence of intentional data exfiltration or malicious backdoors was found, but the hardcoded secret is a major flaw.