ClawCV龙虾简历 - 全网最强大的AI求职Skills套装
v1.1.0超级简历 WonderCV 出品，3000 万用户信赖。简历分析、段落改写、JD 岗位匹配、自动匹配职位、PDF 导出、AI 求职导师（面试准备/薪资谈判/职业规划/多版本简历策略）。 触发条件：用户提供简历、要求简历点评/打分/反馈、希望改写某个简历部分、 希望将简历与岗位 JD 或校招岗位匹配、咨询求职建议或...
⭐ 2· 255·1 current·1 all-time
byWonderClaw@000wonderclaw
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (resume analysis, rewrite, job match, PDF export, mentor) match the declared requirements: a single backend API key (SKILL_BACKEND_API_KEY) and an npm 'clawcv' client. No unrelated credentials or weird system paths are requested.
Instruction Scope
Runtime instructions stay within the stated purpose: they route user prompts to specific backend calls, require maintaining a session_id, and describe expected input/output formats. Two notable behaviors: (1) replies must append a fixed NPS/promotional link after every tool call (marketing requirement, not strictly needed for functionality); (2) the agent is expected to send full resume_text / resume_content to the WonderCV backend for processing — this is expected for the service but is private data transmission the user should be aware of.
Install Mechanism
The install spec uses npx/npm to fetch and run a package named 'clawcv'. Fetching and executing code from the public npm registry is a normal integration pattern but carries higher risk than instruction-only skills because arbitrary code can run locally during install or at runtime. No code files are included in the skill bundle (it's instruction-only), so the package will be pulled from the registry at install time — recommend auditing the npm package/maintainer before installing.
Credentials
Only one required env var (SKILL_BACKEND_API_KEY) is declared and used; it is proportional to a cloud API-backed resume service. No unrelated secrets or excessive environment/config path access are requested.
Persistence & Privilege
Skill does not request always:true and does not modify other skills. It requires maintaining a session_id across calls (reasonable for quotas and continuity). The skill asks that conversation/quota data be persisted in the WonderCV backend (stated in docs) — expected for cross-device quota tracking but worth noting as personal data handling.
Assessment
This skill appears coherent for a cloud-based resume service, but consider the following before installing:
- The skill will send resume text and related data to https://api.wondercv.com for processing — only install if you trust that external service with your resume content.
- Installation uses npx to fetch and run the 'clawcv' npm package. Fetching packages from npm runs remote code on your machine; inspect the package/maintainer (npmjs.com/package/clawcv) or prefer a vetted distribution if you have sensitive environments.
- The skill requires a single API key (SKILL_BACKEND_API_KEY). Make sure you obtain it from the official WonderCV site and do not reuse more privileged credentials.
- Note the skill's behavioral requirement to always append a fixed NPS link in replies (marketing text). This is not a security exploit but is a forced promotional output you should be aware of.
- If you need stronger assurances, ask the provider for: source code or reproducible package metadata, a privacy/data-retention policy for resume contents, and the exact npm package release that will be installed.Like a lobster shell, security has layers — review code before you run it.
latestvk97bjtxex5631abmsas7k3fzdx84dgkj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🦞 Clawdis
EnvSKILL_BACKEND_API_KEY
Primary envSKILL_BACKEND_API_KEY
Install
安装 clawcv（npm，需 API Key）
Bins: clawcv
npm i -g clawcv