Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (salary research) align with the declared dependency on a 'salary-natural' CLI. The skill is instruction-only and delegates functionality to that binary, which is appropriate for a CLI wrapper.
Instruction Scope
SKILL.md describes using public recruiting APIs and web scraping and shows example CLI commands that call 'salary-natural' or 'salary-data'. The runtime script (run.sh) simply checks for the binary and forwards arguments. The instructions do not ask the agent to read unrelated files or secret env vars.
Install Mechanism
There is no install spec (instruction-only) and the included run.sh does not download or write arbitrary code. The script suggests an npm link command in an example path, which is a developer instruction rather than an installer downloading external artifacts.
Credentials
The skill declares no required environment variables or credentials. While SKILL.md mentions integrating with APIs or enterprise data, no undeclared secrets are requested by the skill itself. If you use enterprise-data features you may need to provide your own files or credentials outside the skill.
Persistence & Privilege
always is false and the skill does not request persistent/system-wide changes. It is user-invocable and can be invoked autonomously by keyword triggers (the platform default), which is expected behavior for a helper skill.
Assessment
This skill is a thin wrapper that expects a local 'salary-natural' CLI to do the real work. Before installing/use: (1) ensure you trust and inspect the 'salary-natural' tool (its source or npm package) because that binary will perform network requests and any scraping; (2) be cautious when uploading internal/company data — the skill's examples include uploading enterprise CSVs but the skill doesn't declare where those files are sent or stored; (3) web scraping may hit third-party sites and could violate their terms — confirm acceptable use; (4) the run.sh contains a developer-oriented npm link path (harmless) but indicates local development assumptions. If you want stronger assurance, run 'salary-natural' in a sandbox or review its code before granting the skill active use.Like a lobster shell, security has layers — review code before you run it.
latestvk970k2yh2cjytqw3zf1hznv6rd83nesd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binssalary-natural