Pm Interview Coach

Name/description (PM interview coach) match the behavior: reads resumes (PDF or text), searches Xiaohongshu for interview posts, downloads post images, and uses a multimodal model to extract questions. The included script (fetch_xhs_interview.py) and reference docs directly support the stated functionality. There are no unrelated required env vars or binaries.

SKILL.md mandates collecting resume + company + round and then searching Xiaohongshu and reading post text/images. That stays inside the stated purpose. However the skill explicitly uses: (a) a local mcporter/mcp API to query Xiaohongshu, (b) downloads images from remote URLs, and (c) invokes the MiniMax-VL-01 model for image understanding. The README also lists pdfplumber and mcporter prerequisites. The skill's 'Security Declaration' states it does not upload or transmit resumes/personal info and that processing is local — this can be true only if your agent/tooling keeps all calls local. If your mcporter/mcp or model calls are hosted services, data (images, queries, or resume text) could be sent externally. The skill also writes downloaded images to ~/.openclaw/workspace/xhs_interview_images, which is normal but persistent on disk.

There is no install specification for the skill bundle; it's instruction-heavy with one small Python utility. README suggests pip installs for pdfplumber/pypdf but no automated remote installs are declared in the package. No high-risk download/install URLs are present.

The skill declares no required environment variables or credentials. Runtime interaction does require Xiaohongshu-specific tokens/arguments (feed_id, xsec_token) provided when calling the mcporter tool; these are reasonable for fetching posts. No unrelated secrets (AWS keys, system tokens, etc.) are requested.

always is false and the skill does not request elevated or persistent platform privileges. It writes downloaded images into a skill workspace directory but does not attempt to modify other skills or global agent configuration.