The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly instructs users to provide session cookies (specifically the 'Header String' from the Cookie-Editor extension) for platforms like Boss Zhipin and Lagou. This practice exposes full account authentication tokens to the AI context, allowing potential session hijacking or unauthorized account access if the conversation logs are compromised.
[COMMAND_EXECUTION]: The skill contains multiple executable code snippets:
JavaScript blocks (javascript_exec) designed to be executed via a browser Model Context Protocol (MCP) to scrape live web pages, scroll containers, and extract structured data.
Python scripts using the openpyxl library to generate and modify Excel (.xlsx) files locally.
Python requests snippets to perform network operations using user-supplied session cookies.
[EXTERNAL_DOWNLOADS]: The instructions guide users to download and install several third-party browser extensions (e.g., Cookie-Editor, Claude in Chrome, Codex) to facilitate the extraction of credentials and the control of the browser environment.
[DATA_EXFILTRATION]: By using provided session cookies to make outbound network requests to recruitment platforms, the skill performs authenticated data harvesting. While the stated goal is job searching, this mechanism could be abused to exfiltrate personal user data (resumes, contact info, messages) from the linked accounts.
[PROMPT_INJECTION]: The skill ingests large amounts of untrusted data from job descriptions (JDs) via WebSearch and scraping. It attempts to mitigate risks using a 'quality inspection subagent', but the ingestion of attacker-controlled content from external websites remains a surface for indirect prompt injection attacks.

job-hunt