resume-jd-matcher

This skill appears to implement resume↔JD matching, but proceed cautiously. Key concerns: 1) The repo includes hard-coded API keys and bearer tokens in references/config_resume_match.yaml — treat these as insecure and remove them before use; do NOT assume they are safe or your own. 2) If you enable 'api' mode (or if the skill falls back to the included config), the skill will send full resume text (sensitive personal data) to external third-party endpoints — verify which endpoint and credential will actually be used. 3) main.py expects an import path (resume_match_v2.0.2.py) that isn't in the package — this mismatch could cause failures or unexpected behavior; inspect/repair the entrypoint before running. 4) The skill writes parsed resume JSON files to disk (parsed/ folder) — ensure your environment is secure and permitted to store those files. Recommended actions before installing/running: a) Inspect and remove any embedded api_key values from config files; b) Create/verify a config_resume_match.yaml that uses only your approved endpoints/keys or uses 'subagent' mode; c) Run in a safe test environment with non-sensitive sample resumes; d) Consider disabling API mode or running offline if you cannot verify the third‑party providers; e) Fix the inconsistent import/path references (or run the provided scripts directly) and confirm expected behavior. If you want, I can point to the exact lines/files containing embedded keys and the dynamic import for quick remediation.