猎聘求职助手

猎聘求职助手，封装 Liepin MCP 服务。用于搜索职位、查看 JD、投递简历、管理简历。 **触发场景**： (1) 用户提到"猎聘"、"liepin"、"liepin求职"、"猎聘求职"、"猎聘助手"、"liepin助手"、"找工作"、"搜职位"、"投简历"、"查看简历" (2) 用户提供猎聘 token...

Security Scan

The skill's code matches its stated purpose (using a Liepin MCP token to call the Liepin MCP API), but the package metadata omits the fact that a secret token is required and that the skill can persist that token to disk — an incoherence and privacy risk you should be aware of.

Purpose & Capability

The skill's name/description (Liepin assistant) aligns with the included code and API endpoint (open-agent.liepin.com/mcp/user). However the registry metadata declares no required environment variables or config paths while the SKILL.md and scripts clearly require a LIEPIN_TOKEN and optionally write/read a config.json. That metadata omission is inconsistent and reduces transparency.

Instruction Scope

SKILL.md instructs the agent/user only to supply a LIEPIN_TOKEN and to run the provided scripts for searching/applying/resume management. The runtime instructions and scripts operate only against the documented MCP endpoint and do not reference unrelated system files or external endpoints. They do, however, instruct/implement writing the token to config.json under a skill directory if the environment variable is not set — this persists a secret on disk and is explicitly called out in the docs.

Install Mechanism

No install spec; the skill is instruction-plus-scripts only. There is no download/install step or external package installation, which minimizes additional supply-chain risk.

Credentials

Although only a single service token (LIEPIN_TOKEN) is required for the skill's purpose, the registry metadata did not declare it. The scripts expect LIEPIN_TOKEN (or to persist the token in config.json). Persisting the token to disk is optional but documented — this is reasonable for functionality but has privacy implications and should have been declared explicitly in metadata.

Persistence & Privilege

The skill does not request elevated system privileges nor set always:true. It will create/read/delete a config.json in a skill directory (resolved via LIEPIN_SKILL_DIR or several paths under the user's home). Writing config.json is normal for storing a token but it does give the skill persistent access to the token on disk; the SKILL.md recommends the environment variable as safer.

What to consider before installing

This skill appears to do what it says: it calls the Liepin MCP API and needs your Liepin token. However the registry metadata omitted that required credential and the scripts will optionally persist the token to a config.json under a skill directory (e.g., ~/.openclaw/...). Before installing or using it: (1) prefer setting LIEPIN_TOKEN as an environment variable so the token doesn't get written to disk; (2) inspect or run the included scripts yourself to confirm the config.json path and remove it when done (set-token.js --clear deletes it); (3) confirm the MCP endpoint (open-agent.liepin.com) is expected by you; (4) if you need stronger assurance, ask the publisher to update metadata to declare LIEPIN_TOKEN and the config path, or run the scripts in an isolated environment. The primary issue is metadata/information omission and the token persistence behavior — not hidden network calls or unknown endpoints.

猎聘求职

快速使用

1. 配置 Token：用户发送「设置猎聘token xxx」
2. 搜索职位：说「搜前端职位」
3. 投递简历：确认后说「投递这个职位」

Token 配置

方式一（推荐）：环境变量

最安全，token 不落地，只存在于当前进程环境：

export LIEPIN_TOKEN=<你的token>

方式二：配置文件

如果环境变量未设置，则回退到 config.json：

node scripts/set-token.js <token>

查看当前 token 状态：

node scripts/set-token.js --show

清除已保存的 token：

node scripts/set-token.js --clear

Token 获取方式：打开 https://www.liepin.com/mcp/server → 登录 → 生成凭证 → 复制 token（有效期 90 天）

---

工作流程

1. 搜索职位

关键词、地点均可选；jobKind 通常为 "2"（正式职位）：

node scripts/liepin-mcp.js user-search-job '{"jobName":"AI","address":"北京"}'

2. 投递职位

jobId 必须是数字类型（从搜索结果的职位ID获取），jobKind 从搜索结果获取（通常为 "2"）：

node scripts/liepin-mcp.js user-apply-job '{"jobId":81543059,"jobKind":"2"}'

3. 查看我的简历

node scripts/liepin-mcp.js my-resume '{}'

4. 补充简历信息

修改简历各项（基本信息、工作经历、教育经历、项目经历、求职期望、自我评价）：

# 修改基本信息
node scripts/liepin-mcp.js modify-resume-base-info '{"realName":"姓名","sex":"男","birthday":"19950101"}'
# 添加工作经历
node scripts/liepin-mcp.js add-work-exp '{"compName":"公司名","rwTitle":"职位名称","workStart":"202001","workEnd":"202312"}'

---

注意事项

• Token 有效期 90 天，过期后重新生成并配置
• 频率限制 60 次/分钟，搜索/投递共用配额
• 每次投递前先展示职位详情，用户确认后再投
• jobId 必须是数字类型（不是字符串），jobKind 为字符串
• 所有操作记录可在猎聘 App 查看
• 优先读取环境变量 LIEPIN_TOKEN，未设置则回退到 config.json

错误排查

现象	原因	方案
"token not configured"	未设置过 token	用户发送"设置猎聘token xxx"
"Request failed"	网络问题	等待几秒重试
errCode != 0	业务错误	查看返回的具体错误信息