自动抓取龙港325802人才招聘网职位信息，按用户偏好筛选并整理后发送邮件通知。

This skill largely does what it advertises (scrapes a job site and emails results), but it contains a hardcoded QQ SMTP account and password inside crawl.js and uses a default recipient address. That means scraped results will be sent using the author's email account (and the author could see or receive those results). Before installing or running: (1) Do not run as-is if you care about privacy. Replace the hardcoded SMTP credentials with your own account or configure the code to read SMTP user/pass and sender address from environment variables. (2) Install missing dependency iconv-lite (npm i iconv-lite nodemailer) or fix package.json. (3) Consider using a throwaway/test environment and a throwaway SMTP account for initial testing, or block outbound SMTP if you don't want data leaving your network. (4) Review and, if appropriate, remove the default recipient and verify the target website's scraping policies. If you are uncomfortable editing code or exposing data to the embedded account, mark this skill untrusted.

Type: OpenClaw Skill Name: longgang-job-hunter Version: 1.0.0 The skill is classified as suspicious due to a critical security vulnerability: the `crawl.js` file contains hardcoded SMTP credentials (username `[email protected]` and password `okjybcgpuprncbah`) for sending emails via `smtp.qq.com`. While the skill's stated purpose is to send job search results, exposing these credentials allows anyone with access to the skill bundle to compromise and use this specific email account for unauthorized sending. This constitutes a severe vulnerability, though it does not show clear intent to maliciously attack the user's system or exfiltrate their personal data beyond the job search results themselves.