by 安全扫描
OpenClaw
可疑
high confidenceThe skill's code matches its job-scraping-and-emailing description, but it hardcodes a QQ SMTP account password and other inconsistencies (missing dependency, default recipient) that pose privacy/exfiltration risks and show incoherence in credential handling.
评估建议
This skill largely does what it advertises (scrapes a job site and emails results), but it contains a hardcoded QQ SMTP account and password inside crawl.js and uses a default recipient address. That means scraped results will be sent using the author's email account (and the author could see or receive those results). Before installing or running: (1) Do not run as-is if you care about privacy. Replace the hardcoded SMTP credentials with your own account or configure the code to read SMTP user/...详细分析 ▾
ℹ 用途与能力
Name/description (scrape 325802 and email results) align with included crawl.js which fetches pages, extracts job data, writes jobs_result.txt, and sends email. Sending via SMTP is expected for the advertised '自动发邮件' feature, but the implementation hardcodes a sender account and password in the script rather than asking the user to provide credentials, which is atypical and notable.
⚠ 指令范围
SKILL.md describes only scraping and emailing; the runtime instructions do that and nothing obviously out-of-scope. However the code writes results to disk and transmits results over the network to the job site and to an external SMTP server. SKILL.md does not disclose that the sender SMTP account (and its password) are embedded in the code — users may not realize their scraped data will be sent via a third-party account that the author controls.
ℹ 安装机制
This is instruction-only with bundled code (no install spec). package.json lists nodemailer dependency, package-lock.json includes nodemailer; SKILL.md and crawl.js also mention iconv-lite, but iconv-lite is required by the script yet is missing from package.json/package-lock. That mismatch will break runtime unless the user manually installs iconv-lite.
⚠ 凭证需求
requires.env is empty but the code embeds sensitive SMTP credentials (user: 450733414@qq.com, pass: okjybcgpuprncbah) and a default recipient (450733414@qq.com). The skill does not request or document the use of user-owned SMTP credentials or environment variables, so credential handling is disproportionate and risky: data could be visible to the SMTP account owner, and the secret in code is a clear red flag.
✓ 持久化与权限
always:false and no system-wide changes. The skill writes a local file (jobs_result.txt) and sends network requests, but it does not request elevated persistence or modify other skills or settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/23
Longgang Job Hunter v1.0.0 - Initial release: Automatically crawls job postings from 325802 talent recruitment website. - Filters and organizes jobs based on user preferences, including computer, customer service, foreign trade, and clerical positions. - Collects contact details, job description, experience, and education requirements. - Sends organized job search results to a designated email address. - Supports quick and customized job searches with user-specified preferences and email configuration.
● 可疑
安装命令
点击复制官方npx clawhub@latest install longgang-job-hunter
镜像加速npx clawhub@latest install longgang-job-hunter --registry https://cn.longxiaskill.com镜像同步中
技能文档
自动抓取龙港325802人才招聘网职位信息，整理联系方式，并发送邮件。
功能概述
- 网站抓取：自动抓取325802人才招聘网职位信息
- 智能筛选：根据用户偏好筛选相关职位
- 信息整理：整理职位、公司名、地址、电话、工作经验、学历要求、职位描述
- 自动发邮件：搜索完成后自动发送结果到指定邮箱
首次使用配置
首次使用需要配置以下信息：
1. 求职偏好（必填）
请选择想找的职位类型，可选：
- 电脑相关：电脑绘图、美工、设计、PS、CAD、文员、客服
- 客服：阿里客服、电话客服、在线客服
- 外贸：外贸业务员、外贸跟单
- 文职：文员、录入、仓库管理
- 全部：所有职位
2. 搜索页数（可选，默认5页）
- 前3页、前5页（默认）、前10页
3. 接收邮箱（可选，默认450733414@qq.com）
- 可自定义接收邮箱
使用方法
方案A：快速搜索（使用默认配置）
帮我找工作
方案B：自定义搜索
找工作，偏好：电脑相关，页数：5
方案C：自定义邮箱
找工作，偏好：电脑相关，页数：5，邮箱：test@qq.com
输出格式
技能会生成如下格式的结果并发送邮件：
=== 龙港325802人才招聘网 - 职位信息 ===求职偏好: [偏好]
搜索范围: 前[页数]页
共 [N] 个职位
- [公司名称]
职位: [职位名称]
地址: [公司地址]
电话: [联系方式]
工作经验: [经验要求]
学历要求: [学历要求]
职位描述: [如有]- [公司名称]
...
技术实现
依赖工具
- Node.js - 爬虫脚本运行
- iconv-lite - GBK编码转换
- nodemailer - 邮件发送
核心逻辑
- 抓取网站：使用GBK编码访问325802网站
- 关键词过滤：根据偏好筛选职位
- 不去重：显示全部匹配的职位
- 自动发邮件：使用QQ邮箱SMTP发送
版本信息
- 版本：1.1.0
- 创建日期：2026-02-23
- 支持网站：325802人才招聘网