Job Hunter Gmail

This skill's functionality (compose and send application emails, manage local records) is coherent, but there are important red flags you should address before installing or using it: - Do not rely on the hard-coded MATON_API_KEY in the script. Treat it as a secret: remove it from code and require the user to provide their own credential (and prefer OAuth for Gmail). If you already used this code with the embedded key, consider revoking that key at the Maton/gateway service. - Verify and understand the third-party gateway (gateway.maton.ai). The script sends email content and attachments through that service; only use it if you trust that provider and their data handling. Prefer using Google's official API and OAuth flows if you want direct Gmail integration. - Fix the configuration inconsistencies: SKILL.md, registry metadata, and the code should agree on what env var is required (e.g., GMAIL_API_KEY or MATON_API_KEY) and declare it in the registry. Avoid shipping default credentials. - Review the code for how attachments are selected (resume path) so you don’t unintentionally send sensitive files. The script reads data/resume.json and local resume file paths — ensure those files contain only information you want transmitted. - If you do not trust the Maton gateway or the embedded key, do not run the send functionality. You can still use the non-network parts locally (cover letter generation, local application tracking) after removing or sandboxing network calls. If you want, I can suggest precise code changes to remove the hard-coded key, add explicit env var checks, or switch the script to use OAuth with Google's official API.