job-advisor
从招聘平台(闲鱼兼职、Boss直聘、智联、拉勾、58同城、豆瓣兼职等)抓取招聘信息,根据用户输入的个人特征(技能、地点、时间、薪资期望、工作形式偏好)匹配适合的长期雇佣或临时工机会,按性价比(加权时薪)排序,输出 markdown 推荐报告到当前项目的 markdown 目录。当用户提出"找工作"、"匹配岗位"、"接私活"、"找兼职"、"招聘推荐"、"什么活适合我"等需求时触发。
69
85%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
该 skill 在“并发抓取/结构化抽取”步骤中通过 `mmx web_search` 获取搜索引擎返回的公开招聘页面摘要（外部作者/站点内容），并将其中的 `snippet`/抽取字段（如 title、JD 摘要、pay、description 等）写入 `jobs.json`，随后在“生成报告”阶段把这些文字渲染到 markdown，从而进入 LLM 上下文/提示（间接提示注入风险路径：外部网页摘要 → 结构化抽取 → 报告渲染）。
- Repository
- digoal/blog
- Commit
3b9c83d
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.