Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 1xiaoyueryuer/boss-hr-agent-toolkit --skill boss-recommend-downloadergit clone --depth 1 https://github.com/1xiaoyueryuer/boss-hr-agent-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/1xiaoyueryuer/boss-hr-agent-toolkit/boss-recommend-downloader)<a href="https://agentmods.dev/skills/1xiaoyueryuer/boss-hr-agent-toolkit/boss-recommend-downloader"><img src="https://agentmods.dev/badge/skills/1xiaoyueryuer/boss-hr-agent-toolkit/boss-recommend-downloader/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/1xiaoyueryuer/boss-hr-agent-toolkit/boss-recommend-downloader"><img src="https://agentmods.dev/badge/skills/1xiaoyueryuer/boss-hr-agent-toolkit/boss-recommend-downloader.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00232 | $0.01668 |
| Opus 5 | $0.00116 | $0.00834 |
| Sonnet 5 | $0.00046 | $0.00334 |
| Haiku 4.5 | $0.00023 | $0.00167 |
Grade A, and why
boss-recommend-downloader scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 211 lines — stays where its author put it; the contents beside it link to each section on GitHub.
推荐牛人简历下载
核心目标：安全地从推荐牛人页面拉候选人列表 + 下载完整简历。
安全级别：🟢 极低风险（真实 Edge TLS 指纹 + 随机延迟）
流程
Step 2a: scripts/recommend_list.py
patchright 滚动 + 拦截 geek/list API
↓
Step 2b: scripts/recommend_download.py
patchright + 浏览器 fetch（真实 Edge 指纹）
↓
输出: runs/<run_id>/process/new_resumes.json
核心原理：通过 patchright 在真实 Edge 浏览器内执行 fetch() 调用 BOSS API，
使用浏览器真实的 TLS 指纹和 Cookie，与真人操作完全一致。
前置条件
| 项 | 要求 |
|---|---|
| Python | 3.10+ |
| patchright | pip install patchright |
| Edge | --remote-debugging-port=9222 启动 |
| BOSS 招聘者 | 扫码登录完成（zp_at/wt2/bst cookie 齐全） |
| Step 1 | 已跑通 boss_jd.py，拿到 encryptJobId + run_id |
| 确认门 | runs/<run_id>/run.json.confirmed=true |
登录态由 shared/cdp_preflight.check_login() 自检。
Step 2a: 拉候选人列表
脚本：scripts/recommend_list.py
原理：在推荐牛人页面滚动时，前端懒加载调用 geek/list API。用 patchright 拦截响应，提取候选人 ID。
调用
python scripts/recommend_list.py \
--job-name "<岗位中文名>" \
--encrypt-job-id "<BOSS encryptJobId>" \
--run-id "<run_id>" \
--batch-size 25
参数
| 参数 | 必填 | 说明 |
|---|---|---|
--job-name |
是 | 岗位中文名（jobs.json metadata） |
--encrypt-job-id |
是 | 工作区目录名 = encryptJobId |
--run-id |
是 | 当前 run_id（数据边界） |
--batch-size |
否 | 默认 25；调到 50 也行，但别超过 |
输出
runs/<run_id>/process/recommend_geek_ids.json
Step 2b: 下载简历
脚本：scripts/recommend_download.py
原理：patchright 在浏览器内 fetch /wapi/zpjob/view/geek/info，使用真实 Edge TLS 指纹 + Cookie。
调用
python scripts/recommend_download.py \
--job-name "<岗位中文名>" \
--encrypt-job-id "<BOSS encryptJobId>" \
--run-id "<run_id>" \
--max 5
参数
| 参数 | 必填 | 说明 |
|---|---|---|
--job-name |
是 | |
--encrypt-job-id |
是 | |
--run-id |
是 | |
--max |
否 | 最多下载多少份（建议 5~10 起步） |
输出
| 文件 | 内容 |
|---|---|
runs/<run_id>/process/new_resumes.json |
本次新增成功简历 |
runs/<run_id>/process/failed_resumes.json |
失败列表 |
跨 run 累计简历在 state/resumes_master.json（自动去重）。
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 211 lines · 232 tokens per session scan A 98513ad2a23d
boss-recommend-downloader is a skill published in the GitHub repository 1xiaoyueryuer/boss-hr-agent-toolkit (46 stars, last pushed 1mo ago), licensed MIT. It adds 232 tokens to every session and 1,668 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
computer-use
OS/window-level inspection and input in visible local app windows through orca computer: native apps, external browser windows (Chrome, Edge, Safari), and app webviews. Not for Orca's embedded browser (use orca-cli) or page-only automation (use Playwright or CDP).
opencli-browser
Use when an agent needs to drive a real Chrome window via opencli — inspect a page, fill forms, click through logged-in flows, or extract data ad-hoc. Covers the selector-first target contract, compound form fields, stale-ref handling, network capture, and the agent-native envelopes the CLI returns. Not for writing…
opencli-autofix
Automatically fix broken OpenCLI adapters when commands fail. Load this skill when an opencli command fails — it guides you through collecting a trace artifact, patching the adapter, retrying, and filing an upstream GitHub issue after a verified fix. Works with any AI agent.
opencli-sitemap-author
Use when creating or maintaining OpenCLI site sitemaps: agent-facing navigation, page-state, action, workflow, API-reference, pitfall, and fallback knowledge for a website. Use after browser exploration discovers durable site context, when a sitemap is stale, or when promoting local site knowledge into the repo.
opencli-browser-sitemap
Use when driving a website with opencli browser and sitemap context is available, requested, or needed to avoid blind navigation. Guides agents to consume site sitemap files lazily, choose adapter/browser fallback paths, resume from state signatures, and mark stale sitemap entries without trusting them over live…
playwright
Use when the task requires automating a real browser from the terminal (navigation, form filling, snapshots, screenshots, data extraction, UI-flow debugging) via playwright-cli or the bundled wrapper script.