Viy1204/recruiting-copilot
C2给 HR / 猎头的 AI 招聘工作流：岗位标准梳理、Boss直聘 + 猎聘双通道寻源初筛、市场人才盘点、简历评估、约面试、候选人台账与日报。可装成 Claude Code 插件或 DeepSeek Harness (dsh) 插件——后者自带可直接上手操作的「招聘浏览器」面板；也能配合任意读 AGENTS.md 的 AI 编程助手使用。
★ 50+ · Viy1204/recruiting-copilot source on GitHub · this plugin in the registry
Viy1204/recruiting-copilot is a DeepSeek Harness plugin rated C2 — one powerful capability or sensitive behavior. It patches the dsh runtime, command execution in build output only, base64 decoding in build output only.
Installable plugin — declares a dsh.bundle manifest
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| patches the dsh runtime | runtime_patch | ./dsh/cordis.patch.yml |
| command execution in build output only | exec_bundled | ×2 in build output only, e.g. lib/index.js:35, lib/index.js:1079 |
| base64 decoding in build output only | base64_decode_bundled | ×2 in build output only, e.g. lib/index.js:558, lib/index.js:863 |
Outbound domains
www.zhipin.com lpt.liepin.com
Environment variables it reads
RECRUIT_BROWSER_HIDDEN CHROME_PATH PUPPETEER_EXECUTABLE_PATH LOCALAPPDATA PROGRAMFILES
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.