Resume JD Match — JD定制简历

AI-powered JD-matched resume generator with native Chinese and English support. Collects structured user profile (work history, projects, skills, education),...

This skill appears to be what it claims (a resume/JD matching tool) but there are two things to check before use: (1) Ask or inspect the contents of scripts/export-pdf.ps1 (not provided) to ensure the export runs locally and does not call external endpoints or execute unexpected commands. (2) Confirm how URL inputs are handled — if the agent will fetch remote job-page URLs, understand that network requests will occur despite the SKILL.md's "No network requests" statement. Also: be aware the skill stores sensitive personal data in workspace/resume-profile.md and in resumes/; if you install, keep that workspace private or review/remove the profile file after use. If you can't inspect the export script or get clarity on URL fetching, treat this skill cautiously or run it in a restricted/sandboxed environment.

Type: OpenClaw Skill Name: resume-jd-match Version: 2.0.0 The skill facilitates resume generation but includes a high-risk shell execution step in SKILL.md. It invokes a PowerShell script (scripts/export-pdf.ps1) using variables ($htmlPath, $pdfPath) derived from user-provided data like 'Name' and 'Title', which creates a potential shell injection vulnerability. While the behavior aligns with the stated purpose of PDF export, the use of external scripts and shell commands without explicit sanitization logic is a risky capability that warrants a suspicious classification.