boss-greeting message

BOSS直聘打招呼语生成器。调用 boss-cli 获取目标职位详情，分析岗位核心要求， 再对照用户简历找出最匹配的经历，生成一段不超过200字的个性化打招呼语。 当用户说"帮我写打招呼语"、"投这个岗位怎么打招呼"、"生成boss打招呼"等时触发。

Security Scan

The skill's instructions match its stated purpose (generating BOSS直聘打招呼语) but there are mismatches and privacy-sensitive actions (use of an external CLI that may read browser cookies and installing an unknown tool) that are not declared in the registry metadata.

Purpose & Capability

The skill's name and description match the runtime instructions: it uses a boss CLI to fetch job details, compares them to a user resume, and generates messages. However the registry metadata declares no required binaries while the SKILL.md explicitly requires 'boss-cli' (and suggests installing 'kabi-boss-cli'), which is an inconsistency between metadata and runtime instructions.

Instruction Scope

SKILL.md instructs the agent to run local commands (boss status/login/search/show) and to read a user-provided resume file path (.md/.txt/.pdf). It also notes that 'boss login' may 'automatically read browser Cookie' — this implies access to browser session data/cookies, which is outside the simple text-processing purpose and is sensitive. Reading a user-supplied file path is expected, but the instructions don't limit or caution about arbitrary local file paths.

Install Mechanism

There is no official install spec in the registry, but the SKILL.md suggests 'uv tool install kabi-boss-cli'. The source and trustworthiness of that installer/package are not specified — installing unknown third-party CLIs is higher risk. Because this is instruction-only, the skill itself doesn't write files, but it directs the user/agent to install an external binary from an unspecified source.

Credentials

No environment variables or credentials are declared, yet the skill relies on boss-cli which may authenticate by reading browser cookies or prompting QR login. That implicit credential access (browser cookies/session) is not declared. The skill also asks to read resume files by path; this can expose arbitrary local data if misused. The absence of declared credentials/config while the instructions reference credential-bearing browser cookies is a proportionality/visibility concern.

Persistence & Privilege

The skill does not request permanent presence (always:false), does not modify other skills or global config, and is user-invocable. Autonomous invocation is allowed by default but is not combined here with broad undeclared credentials or persistent privileges.

What to consider before installing

This skill appears to do what it promises (use a boss CLI and your resume to craft two greeting messages), but take these precautions before installing or running it: - Verify the boss-cli being referenced (kabi-boss-cli) — where does it come from? Prefer official or well-known releases (GitHub org, vendor site). Don't run installers from unknown sources. - Be aware that 'boss login' may read browser cookies or create a session; that gives the CLI access to your site account session. Only proceed if you trust the CLI tool's provenance and code. - When asked for a resume, prefer pasting the resume text into the conversation rather than giving an arbitrary local file path, or only supply a file you trust and have inspected. Avoid giving paths to sensitive system files. - The registry metadata does not declare the required boss-cli binary; ask the skill author to correct metadata and to document the CLI's install source and permissions. - If you need higher assurance, request the author provide a homepage/repository for the skill and the boss-cli, and ideally an install spec that points to a verified release. If those are not available, treat the install step as risky.

BOSS直聘打招呼语生成器

Step 0：检查 boss-cli 登录状态

boss status

• 已登录 → 跳到 Step 1

• 未登录 → 提示用户：

  需要先登录 BOSS直聘：

  boss login
  

  会自动读取浏览器 Cookie，或弹出二维码扫码登录。 登录完成后重新触发本 skill。

  如果还没安装 boss-cli，先安装：

  uv tool install kabi-boss-cli
  

---

Step 1：获取目标职位信息

如果用户没有提供职位，询问：

你想投哪个职位？可以直接告诉我：

1. BOSS直聘的职位链接
2. 或者职位名称 + 公司名（我来帮你搜）

情况A：用户提供了职位链接

从链接中提取职位 ID（URL 中的数字部分），直接获取详情：

boss show <职位ID>

情况B：用户提供职位名称 + 公司名

先搜索，展示结果让用户确认：

boss search "<职位名称>" --company "<公司名>"

展示搜索结果，请用户选择序号，再：

boss show <序号>

记录以下职位信息供后续分析：

• 职位名称
• 公司名称、规模、融资阶段
• 薪资范围
• 岗位职责（JD）
• 任职要求

---

Step 2：获取用户简历

询问用户：

请提供你的简历，可以是：

1. 简历文件路径（支持 .md / .txt / .pdf）
2. 或直接把简历内容粘贴过来

读取简历内容，提取：

• 当前/最近职位和公司
• 工作年限
• 核心技能
• 最有代表性的项目/成果（优先提取有数据的成果，如「提升XX%」「负责XX万用户」）

---

Step 3：分析匹配点

综合职位详情和简历，分析：

岗位最关注什么：

• 从 JD 的职责描述中，找出排在前3位的核心能力要求
• 从任职要求中，找出硬性门槛（学历/年限/技能）和加分项
• 结合公司阶段（初创/成长/上市）判断他们更看重「经验」还是「潜力」

简历中最匹配的部分：

• 找出与岗位核心要求直接对应的经历或技能
• 优先选有具体数字/成果的内容，而非泛泛描述
• 最多提取3个匹配点，不要堆砌

---

Step 4：生成打招呼语

基于以上分析，生成打招呼语，严格遵守以下规则：

内容规则：

• 第一句点明应聘岗位
• 核心内容：用1-2句话说出与岗位最匹配的经历/能力，必须具体，不能只说「有相关经验」
• 结尾：简短表达期待沟通的意愿，不要用「期待您的回复」这类套话
• 严格不超过200字

风格规则：

• 口语化，像真人写的，不像模板
• 不用「贵公司」「您好」等过度正式的词
• 不堆砌形容词（「优秀」「出色」「丰富」一律删掉）
• 不写自己的弱点或不确定的内容

生成 2个版本：

• 版本A（经验导向）：突出过往成果，适合强调匹配度
• 版本B（简洁直接）：一句话定位 + 一句话亮点，适合对方很忙

每个版本后注明实际字数。

---

输出模板

## 📋 职位分析

**公司：** {公司名} | {融资阶段} | {规模}
**岗位核心要求（TOP3）：**
1. {要求1}
2. {要求2}
3. {要求3}

**你的最强匹配点：**
- {匹配点1}
- {匹配点2}

---

## ✉️ 打招呼语

**版本A（经验导向）**（XX字）
{打招呼语内容}

**版本B（简洁直接）**（XX字）
{打招呼语内容}

---

💡 使用建议：如果对方是 HR，用版本A；如果对方是业务负责人，用版本B。