Agent skill · Audited from source
boss-cli
skill · jackwener/boss-cliLicence not declaredAudited 20 Oct 2026 · source 588301faf9e0
Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 588301faf9e0 and observed network access and no hard-coded secrets. What it does: Use boss-cli for ALL BOSS 直聘 operations — searching jobs, viewing recommendations, managing applications, chatting with recruiters, and batch greeting. Invoke whenever the user requests any job search or recruitment…
Cite
Cite this page
ModelsAtlas. “boss-cli (jackwener/boss-cli)”. Retrieved 20 Oct 2026. https://modelsatlas.com/skills/jackwener/boss-cli
Trust audit
Audit 0.4.1 · source read 20 Oct 2026
SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkDeclared5 observations
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 1 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | PASS | 6 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass, no license.
Findings (7)
LOWInventory / provenanceinv.no_license
- Why
- no LICENSE file and no repo licence
- Fix
- add a licence
LOWNetwork egressnet.raw_ip · README.md:225
$env:BOSS_CDP_URL = "http://127.0.0.1:9222"
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · tests/test_cdp_auth.py:45
@pytest.mark.parametrize("url", ["http://example.com:9222", "http://192.168.1.1:9222", "file:///tmp/cdp", "http://user:[email protected]:9222", "http://127.0.0.1:bad", "http://127.0.0.1:9222/?token=secre- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · tests/test_cdp_auth.py:53
@pytest.mark.parametrize("url", ["ws://example.com/page", "ws://192.168.1.1/page", "https://127.0.0.1/page"])- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · tests/test_cdp_auth.py:70
client.return_value.__enter__.return_value.get.assert_called_once_with("http://127.0.0.1:9222/json/list")- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · tests/test_cdp_auth.py:79
cred, diagnostics = auth._extract_via_cdp("http://127.0.0.1:9222")- Why
- No further detail recorded for this rule.
- Fix
- —
LOWPrivilege escalation / persistencepriv.escalate · .github/workflows/ci.yml:22
run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev
- Why
- asks for elevated privileges
- Fix
- —
Audit 0.4.1 · source sha 588301faf9e0 · 20 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherjackwener GitHub userOwner of the repository this skill is read from
- Source folderjackwener/boss-cliThe exact folder we audited
- LicenceNot declaredAs the repository states it
- Commit pinned for this verdict588301faf9e0A new audit runs when the source changes
- Repository statusNot archivedLast push 11 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Use boss-cli for ALL BOSS 直聘 operations — searching jobs, viewing recommendations, managing applications, chatting with recruiters, and batch greeting. Invoke whenever the user requests any job search or recruitment…
---
name: boss-cli
description: Use boss-cli for ALL BOSS 直聘 operations — searching jobs, viewing recommendations, managing applications, chatting with recruiters, and batch greeting. Invoke whenever the user requests any job search or recruitment platform interaction on BOSS 直聘.
author: jackwener
version: "0.3.0"
tags:
- boss
- zhipin
- boss直聘
- job-search
- recruitment
- cli
---
# boss-cli — BOSS 直聘 CLI Tool
**Binary:** `boss`
**Credentials:** browser cookies (auto-extracted from 10+ browsers) or QR code login (`--qrcode`)
## Setup
```bash
# Install (requires Python 3.10+)
uv tool install kabi-boss-cli
# Or: pipx install kabi-boss-cli
# Upgrade to latest (recommended)
uv tool upgrade kabi-boss-cli
# Or: pipx upgrade kabi-boss-cli
```
## Authentication
**IMPORTANT FOR AGENTS**: Before executing ANY boss command, check if credentials exist first. Do NOT assume cookies are configured.
### Step 0: Check if already authenticated
```bash
boss status --json 2>/dev/null | jq -r '.authenticated' | grep -q true && echo "AUTH_OK" || echo "AUTH_NEEDED"
```
If `AUTH_OK`, skip to [Command Reference](#command-reference).
If `AUTH_NEEDED`, proceed to Step 1.
### Step 1: Guide user to authenticate
Ensure user is logged into zhipin.com in any supported browser (Chrome, Firefox, Edge, Brave, Arc, Chromium, Opera, Vivaldi, Safari, LibreWolf). Then:
```bash
boss login # auto-detect browser with valid cookies
boss login --cookie-source chrome # specify browser explicitly
boss login --qrcode # QR code login — scan with Boss app
```
Verify with:
```bash
boss status
boss me --json | jq '.data.name'
```
### Step 2: Handle common auth issues
| Symptom | Agent action |
|---------|-------------|
| `环境异常 (__zp_stoken__ 已过期)` | Run `boss logout && boss login` |
| `未登录` | Run `boss login` |
| Rate limited (code=9) | Auto-cooldown built-in; wait and retry |
| API timeout | Check network, retry |
## Agent Defaults
All machine-readable output uses the envelope documented in [SCHEMA.md](./SCHEMA.md).
Payloads live under `.data`.
- Non-TTY stdout → auto YAML
- `--json` / `--yaml` → explicit format
- Rich output → **stderr** (safe for pipes: `boss search X --json | jq .data`)
## Command Reference
### Search & Browse
| Command | Description | Example |
|---------|-------------|---------|
| `boss search <keyword>` | Search jobs with filters | `boss search "golang" --city 杭州 --salary 20-30K` |
| `boss show <index>` | View job #N from last search | `boss show 3` |
| `boss detail <securityId>` | View full job details | `boss detail abc123 --json` |
| `boss export <keyword>` | Export search results to CSV/JSON | `boss export "Python" -n 50 -o jobs.csv` |
| `boss recommend` | Personalized recommendations | `boss recommend -p 2 --json` |
| `boss history` | View browsing history | `boss history --json` |
| `boss cities` | List supported cities | `boss cities` |
### Personal Center
| Command | Description | Example |
|---------|-------------|---------|
| `boss me` | View profile (name, age, degree) | `boss me --json` |
| `boss applied` | View applied jobs | `boss applied -p 1 --json` |
| `boss interviews` | View interview invitations | `boss interviews --json` |
| `boss chat` | View communicated bosses | `boss chat --json` |
### Actions
| Command | Description | Example |
|---------|-------------|---------|
| `boss greet <securityId>` | Greet a boss / apply | `boss greet abc123 --json` |
| `boss batch-greet <keyword>` | Batch greet from search | `boss batch-greet "Python" --city 杭州 -n 5` |
| `boss batch-greet <keyword> --dry-run` | Preview without sending | `boss batch-greet "golang" --dry-run` |
### Account
| Command | Description |
|---------|-------------|
| `boss login` | Extract cookies from browser (auto-detect, fallback QR) |
| `boss login --cookie-source <browser>` | Extract from specific browser |
| `boss login --qrcode` | QR code login only (terminal QR output) |
| `boss status` | Check authentication status (shows cookie names) |
| `boss logout` | Clear saved credentials |
## Search Filter Options
| Filter | Flag | Values |
|--------|------|--------|
| City | `--city` | 北京, 上海, 杭州, 深圳, etc. (use `boss cities` for full list) |
| Salary | `--salary` | 3K以下, 3-5K, 5-10K, 10-15K, 15-20K, 20-30K, 30-50K, 50K以上 |
| Experience | `--exp` | 不限, 在校/应届, 1年以内, 1-3年, 3-5年, 5-10年, 10年以上 |
| Degree | `--degree` | 不限, 大专, 本科, 硕士, 博士 |
| Industry | `--industry` | 互联网, 电子商务, 游戏, 人工智能, 金融, 教育培训, 医疗健康, etc. |
| Company Scale | `--scale` | 0-20人, 20-99人, 100-499人, 500-999人, 1000-9999人, 10000人以上 |
| Funding Stage | `--stage` | 未融资, 天使轮, A轮, B轮, C轮, D轮及以上, 已上市, 不需要融资 |
| Job Type | `--job-type` | 全职, 兼职, 实习 |
## Agent Workflow Examples
### Search → Batch Greet pipeline
```bash
# Preview first
boss batch-greet "golang" --city 杭州 --salary 20-30K --dry-run
# Then execute
boss batch-greet "golang" --city 杭州 --salary 20-30K -n 10 -y
```
### Search → Detail pipeline (structured)
```bash
# Search and extract securityId
SEC_ID=$(boss search "golang" --city 杭州 --json | jq -r '.data.jobList[0].securityId')
# Get full detail
boss detail "$SEC_ID" --json | jq '.data.jobInfo | {jobName, salaryDesc, skills}'
```
### Daily job check workflow
```bash
boss recommend --json | jq '.data.jobList | length' # Check recommendations count
boss search "Python" --city 杭州 --json # Search specific jobs
boss show 1 # View top result details
boss applied --json # Check application status
boss interviews --json # Check interview invitations
boss chat --json # Check messages
boss history --json # Review browsing history
```
### Export pipeline
```bash
boss export "golang" --city 杭州 --salary 20-30K -n 50 -o jobs.csv
boss export "Python" -n 100 --format json -o jobs.json
```
##Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 588301f
uv tool install kabi-boss-cli pip install kabi-boss-cli[yaml] uv tool upgrade kabi-boss-cli git clone [email protected]:jackwener/boss-cli.git uv sync npx skills add jackwener/boss-cli
git clone https://github.com/jackwener/boss-cli git -C boss-cli checkout 588301faf9e0
Commands as the repository documents them: shown, never run by us. Our verdict covers commit 588301faf9e0 only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| OpenClaw | Mentioned in its text, not tested | Skills for OpenClaw · About OpenClaw |
Audit history
Every audit, every source change
- ✓SAFE B 89 / 100
first audit · source
588301faf9e0
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/jackwener/boss-cli/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
obra/superpowers
Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions…
obra/superpowers
Use when you have a spec or requirements for a multi-step task, before touching code
obra/superpowers
Use when starting any conversation - establishes how to find and use skills, requiring skill invocation before ANY response including clarifying questions
Add this badge to your README
[](https://modelsatlas.com/skills/jackwener/boss-cli/)
<a href="https://modelsatlas.com/skills/jackwener/boss-cli/"><img src="https://modelsatlas.com/skills/jackwener/boss-cli/badge.svg" alt="ModelsAtlas: SAFE B"></a>
Questions about boss-cli
What does the boss-cli skill do?
Is boss-cli safe to install?
What can boss-cli access on my machine?
Which assistants does boss-cli work with?
How current is this page?
Sources
- github.com/jackwener/boss-cli — the audited source at commit 588301faf9e0 and every finding aboveObserved · 20 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the boss-cli skill do?
- Is boss-cli safe to install?
- What can boss-cli access on my machine?