HH OpenClaw Agent

Public OpenClaw skill for preparing a reviewed hh.ru application packet, executing the browser flow in a logged-in profile, and capturing one auditable submi...

Security Scan

The skill's files, instructions, and requirements are consistent with its stated purpose (preparing and validating an hh.ru application packet and audit trail) and do not request unrelated credentials or install remote code.

Purpose & Capability

Name/description match the included scripts and guidance: all code is focused on creating, appending to, validating, and rendering a local hh.ru submission bundle. Required binaries (python3/python) are appropriate and no extraneous credentials or unrelated tools are requested.

Instruction Scope

SKILL.md stays on-topic: it instructs initializing a packet, recording browser steps (using an already-authenticated profile), validating the bundle, and rendering a report. It explicitly treats authentication/CAPTCHA/2FA as operator-handled and does not direct reading of unrelated files or sending data to external endpoints.

Install Mechanism

No install spec; the skill is instruction-only plus bundled Python scripts. All code is plain Python source included in the package — nothing is downloaded or executed from remote URLs.

Credentials

The skill requires no environment variables or credentials. Scripts operate on local files and paths only; they explicitly flag absolute/private artifact paths and redact non-hh.ru URLs by default, which is proportionate to the stated goal.

Persistence & Privilege

always is false and the skill does not request persistent or elevated platform privileges. It does not modify other skills or global agent configuration.

Assessment

This package appears coherent and focused: it only manipulates local JSON bundles and produces reports. Before using, ensure you run it in a workspace that contains the expected artifact files (screenshots, snapshots) and avoid including cookies, secrets, or private filesystem paths in artifact fields — the scripts will flag or redact absolute/private paths but won't strip secrets from content unless you opt into full exports with --include-sensitive.

Goal

Turn one hh.ru application run into a reusable submission bundle:

• one machine-readable application packet
• one ordered execution log with evidence
• one structural bundle check
• one shareable markdown report

This skill is for reviewed hh.ru browser execution through OpenClaw. It assumes the browser profile is already authenticated.

Use This Skill When

• the user wants to prepare and submit an hh.ru application through OpenClaw
• a vacancy-specific packet should be reviewed before the live browser write
• the same hh.ru response flow needs an auditable run log instead of chat memory
• a blocked or failed submission needs screenshots, exact steps, and a handoff report
• the operator wants one record of approved content and live browser outcome

Quick Start

1. Initialize the application packet.

   • Use python3 {baseDir}/scripts/init_hh_application_packet.py --out <json> --packet-id <id> --vacancy-id <id> --vacancy-title <title> --company-name <company> --resume-title <resume> --vacancy-url <url> --apply-url <url> --cover-letter <text>.
   • Add --browser-profile, --review-status, --reviewer, and repeatable --blocked-action fields when needed.

2. Execute the browser flow through OpenClaw.

   • Open the apply URL in a logged-in profile.
   • Record each meaningful browser action with append_hh_execution_step.py.
   • Capture screenshots and outcome notes as the run progresses.

3. Keep operator-owned auth and approval gates explicit.

   • If hh.ru shows login, CAPTCHA, 2FA, or another auth challenge, stop and let the operator complete it in the same browser profile.
   • Do not live-send a packet that is still pending or rejected.

4. Check the bundle before sharing or counting it as complete.

   • Use python3 {baseDir}/scripts/check_hh_submission_bundle.py --manifest <json> --repo-root <repo> --out <json>.
   • Fix approval-gate issues, missing screenshots, or incomplete failed-step notes before final handoff.

5. Render the report.

   • Use python3 {baseDir}/scripts/render_hh_submission_report.py --manifest <json> --out <md>.
   • The default report redacts the cover letter body, keeps only public https://*.hh.ru/... URLs, and redacts private artifact paths.
   • Add --include-sensitive only when you intentionally need a full-content export.
   • Share the report instead of loose screenshots and manual notes.

Operating Rules

Packet rules

• Keep one packet per vacancy response flow.
• The cover letter should stay vacancy-specific.
• Record vacancy URL, apply URL, resume title, and approval state before opening the live form.

Execution rules

• Use a logged-in OpenClaw browser profile for the live hh.ru session.
• Record expected result and actual result for every meaningful step.
• Capture a screenshot for failed or blocked steps and for the final submitted state when possible.
• Keep artifact paths relative so the bundle can move between machines.

Safety rules

• Do not claim undocumented hh.ru write APIs.
• Do not store cookies, secrets, or tokens in notes or artifacts.
• Do not send a live application unless the packet review state is approved.
• Treat login, CAPTCHA, passkey, and 2FA as operator-owned interruptions, not background automation.

Bundled Scripts

• scripts/init_hh_application_packet.py
  • Create a machine-readable application packet for one hh.ru response flow.
• scripts/append_hh_execution_step.py
  • Append one evidence-backed browser execution step to the packet.
• scripts/check_hh_submission_bundle.py
  • Validate approval state, execution evidence, and bundle safety before handoff.
• scripts/render_hh_submission_report.py
  • Render a concise markdown report from the packet and execution log.