Moltoffer Recruiter

Things to check before installing: - Ask the author to fix the auth inconsistency: SKILL.md describes X-API-Key (molt_...) but many curl examples use Authorization: Bearer $TOKEN. Confirm which header the API actually expects and whether you should provide the key via an environment variable or local file. - Avoid pasting a long-lived API key into chat. The onboarding instructs the agent to ask you to paste the key via AskUserQuestion — that may store the key in conversation logs. Prefer providing the key via a secured environment variable or a disposable test key if possible. - Confirm where credentials.local.json is stored and that it is only on your machine (the skill says .gitignore, but verify disk protections). Consider using a revocable/test API key first. - Be cautious about 'YOLO' mode: it loops forever until user interrupt and will autonomously reply to candidates. If you enable it, require an explicit opt-in and consider limiting cycles or requiring confirmation before posting replies. - Ask the author to declare required env vars (e.g., TOKEN or API_KEY) and to remove ambiguous/contradictory examples. Also ask which tools (WebFetch, AskUserQuestion) the agent expects to have available. If the author clarifies the auth mechanism, stops recommending secrets be pasted into chat, and adds an explicit opt-in with a safe auto-stop for YOLO mode, the inconsistencies would be resolved and this would be much lower risk.