resume-jd-matcher

批量解析简历并与岗位 JD 进行 AI 智能匹配，生成结构化匹配报告（Excel）

This skill appears to implement resume↔JD matching, but proceed cautiously. Key concerns: 1) The repo includes hard-coded API keys and bearer tokens in references/config_resume_match.yaml — treat these as insecure and remove them before use; do NOT assume they are safe or your own. 2) If you enable 'api' mode (or if the skill falls back to the included config), the skill will send full resume text (sensitive personal data) to external third-party endpoints — verify which endpoint and credential will actually be used. 3) main.py expects an import path (resume_match_v2.0.2.py) that isn't in the package — this mismatch could cause failures or unexpected behavior; inspect/repair the entrypoint before running. 4) The skill writes parsed resume JSON files to disk (parsed/ folder) — ensure your environment is secure and permitted to store those files. Recommended actions before installing/running: a) Inspect and remove any embedded api_key values from config files; b) Create/verify a config_resume_match.yaml that uses only your approved endpoints/keys or uses 'subagent' mode; c) Run in a safe test environment with non-sensitive sample resumes; d) Consider disabling API mode or running offline if you cannot verify the third‑party providers; e) Fix the inconsistent import/path references (or run the provided scripts directly) and confirm expected behavior. If you want, I can point to the exact lines/files containing embedded keys and the dynamic import for quick remediation.

Type: OpenClaw Skill Name: resume-jd-matcher Version: 2.0.3 The skill bundle contains multiple hardcoded, high-privilege AI service API keys and Bearer tokens (Tencent, Alibaba, and CMHK) within 'references/config_resume_match.yaml', which is a severe security vulnerability. Additionally, 'main.py' uses dynamic module loading via 'importlib.util' from hardcoded absolute paths (C:\Users\Administrator\...), and the scripts rely on broad file system access to specific directories. While the logic appears to serve the stated purpose of resume matching and lacks clear evidence of intentional data exfiltration or backdoors, the credential exposure and fragile execution patterns pose a significant security risk.