UP 简历求职助手

This skill appears to do what it claims, but review these before you proceed: 1) Confirm tooling: the instructions rely on the 'claude' CLI and on Node's npx; these binaries are not listed in the metadata. Make sure you have/expect those tools on your machine. 2) API key handling: the SKILL.md asks you to supply an API key to 'npx @upcv/mcp-server' but doesn't explain how/where that key is stored. Ask or inspect how the MCP server/claude stores credentials before handing over secrets. 3) npm package risk: the install step uses 'npx @upcv/mcp-server' (downloads code from npm). Verify the package source (e.g., GitHub repo) and review its code or reputation before running. 4) Persistent changes: the skill creates monitor.sh, writes reports to ~/.jobsclaw/, creates ats-records/ and sets cron/launchd jobs. Inspect monitor.sh and the plist/cron entry before enabling automatic runs and ensure you consent to scheduled network queries. 5) Data disclosure: monitor.sh uses 'claude -p' to run queries automatically; consider what data will be sent in those scheduled queries and where results are stored. Avoid storing highly sensitive personal identifiers in recorded files; the skill itself warns not to auto-fill ID numbers. If you want to proceed, verify the upcv/clawjob service legitimacy (clawjob.upcv.tech), inspect the npm package @upcv/mcp-server, and review any generated scripts and scheduled-job definitions before loading them.