Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Viy1204/recruiting-copilot --skill recruit-initgit clone --depth 1 https://github.com/Viy1204/recruiting-copilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/viy1204/recruiting-copilot/recruit-init)<a href="https://agentmods.dev/skills/viy1204/recruiting-copilot/recruit-init"><img src="https://agentmods.dev/badge/skills/viy1204/recruiting-copilot/recruit-init/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/viy1204/recruiting-copilot/recruit-init"><img src="https://agentmods.dev/badge/skills/viy1204/recruiting-copilot/recruit-init.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 110 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 121 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00136 | $0.02019 |
| Opus 5 | $0.00068 | $0.01009 |
| Sonnet 5 | $0.00027 | $0.00404 |
| Haiku 4.5 | $0.00014 | $0.00202 |
Grade A, and why
recruit-init scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 122 lines — stays where its author put it; the contents beside it link to each section on GitHub.
recruit-init —— 初始化招聘工作区
首次使用时跑一次。目标：搭好一个「任何 AI 工具打开都能直接干活」的招聘工作区。
Step 1 前置依赖检查
先定位本 SKILL.md 所在的目录，然后运行它自带的安装脚本。在本模板仓库根目录中的命令是：
sh skills/recruit-init/scripts/install-dependencies.sh
脚本会检查 Node.js，安装 Boss / 猎聘 CLI，并在 macOS 等环境中自动修复 npm
全局命令的 PATH。默认安装已适配当前 Boss 前端的维护版：
git+https://github.com/Viy1204/boss-cli.git#main。如需替换来源，可在运行前设置
BOSS_CLI_SOURCE。
如果当前 agent 没有全局安装权限，先给同一脚本加 --check-only
获取诊断结果。无论是权限、Node/npm/git 缺失、网络、构建还是包安装失败，
都不阻塞建工作区：记下原始错误和待用户处理项，继续 Step 2，不要在同一失败路径上反复重试。
安装后依次确认：
node --version—— 需要 Node ≥ 20。没有 → 引导去 https://nodejs.org 装 LTS。boss help—— Boss 直聘 CLI。没有 → 重跑安装脚本。不要直接用npm install -g git+...：部分 npm 版本会把它留成指向临时缓存的符号链接。 本脚本会先构建并打包 fork，再安装持久化的包文件。liepin --version—— 猎聘 CLI。没有 → 重跑同一安装脚本，不另外维护第二条安装路径。- 本机装有 Chrome 或 Edge（两个 CLI 都靠它驱动真实浏览器）。
- 可选：
lark-cli --version—— 有且已配置飞书应用凭证 → 日报出飞书云文档、 约面试可直接建日历日程，也可从飞书邮箱收取简历；没有 → 明确告知用户 "日报将输出本地 Markdown 到 runtime/reports/，约面试提供手动建会清单，邮箱简历需本地提供； 寻源、本地简历 review 和台账功能不受影响"。不要求用户必须装。
在 macOS 上，如果 npm 全局命令目录原本不在 PATH，脚本会用可重复执行的配置块
更新当前 shell 的配置文件（zsh 为 ~/.zprofile，bash 为 ~/.bash_profile）：
安装过程立即使用新路径，用户之后新开的终端也会自动生效。
装好 CLI 后提醒用户各跑一次 boss login 和 liepin login（扫码登录，登录态持久化）。
如果用户此刻登录不了（比如手机不在身边），记入收尾提醒，继续建仓。
Step 2 创建工作区骨架
先探查，再动手：问用户工作区放哪（推荐一个独立文件夹，如 ~/recruiting 或桌面某目录），
看一眼目标位置——如果已存在 CONTEXT.md 或台账，说明是已有工作区，进入修复模式：
只补缺失的文件和目录，绝不覆盖已有的 CONTEXT/台账/JD，逐项报告补了什么。全新目录才走完整创建：
<workspace>/
├── AGENTS.md ← 从本 skill 的 templates/AGENTS.md 复制
├── CONTEXT.md ← 从 templates/CONTEXT.md 复制
├── skills/ ← 把模板仓库 skills/ 全部拷入（含 recruit-init 与 references/），
│ 这是所有工具共用的唯一 skill 内容源，工作区从此自足
├── .agents/skills/ ← 指向 skills/ 的项目级链接（Codex / Agent Skills 约定）
├── .claude/skills/ ← 指向 skills/ 的项目级链接（Claude Code）
├── .qoder/skills/ ← 指向 skills/ 的项目级链接（Qoder）
├── 01-jd/
│ ├── _internal/ ← 对内笔记（不外发）
│ └── _dist/ ← 生成物（PDF/HTML 等）
├── 02-sourcing/
│ ├── dedup-ledger.csv ← 从 templates/dedup-ledger.csv 复制（只有表头）
│ └── candidate-pool.md ← 从 templates/candidate-pool.md 复制
├── 03-interview/
├── 04-offer/
├── 05-onboarding/
├── _shared/templates/ ← 复制 jd-internal.md / interview-record.md /
│ candidate-pool.md / dedup-ledger.csv 四个模板
└── runtime/
├── reports/ ← 本地日报与 review 汇总
└── resumes/ ← 邮件简历附件与导入去重索引
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 122 lines · 136 tokens per session scan A e20f5694440b
recruit-init is a skill published in the GitHub repository Viy1204/recruiting-copilot (63 stars, last pushed 8d ago), licensed MIT. It adds 136 tokens to every session and 2,019 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
recipe-plan
Create work plan from design document and obtain plan approval.
service-desk
Runs the IT service desk — intake, triage, prioritization, escalation, knowledge, and the metrics that improve service rather than distort it. Use this to set up or fix a service desk, design ticket priority and escalation, reduce repeat contacts, structure a knowledge base, or work out why a desk hitting its targets…
alive:bundle
Create, share, and graduate bundles — the unit of focused work within a walnut. Manages the full bundle lifecycle from creation through sharing to graduation.
job
Daily routines for a corporate software engineering job. Start mode triages the inbound review queue, your own open PRs, and the issue tracker's plan for today. End mode clears the outbox, surfaces review debt, sweeps worktrees for unpushed work, and tidies tracker state for tomorrow. Use via /job, /job start, /job…
status
Read every application.yaml in the workspace and report the state of the search — the ranked queue, what is waiting on you, what has gone quiet, and the regression of the pipeline's own predictions against actual outcomes. Writes the calibration findings back into jobsearch.md and preferences.yaml.
skill-task-management
Manage tasks with Claude Code native tools — use to track TODOs, delegate work, and monitor progress.