The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes instructions to the agent to use an 'AUTO-PROCEED' mode, explicitly stating 'DO NOT ask for confirmation at routine steps' and 'JUST DO IT'. These instructions encourage the agent to bypass interactive safety checks and reduce user oversight during complex workflows.
[INDIRECT_PROMPT_INJECTION]: The skill extracts data from arbitrary external job URLs to score fit and generate application materials. This content is treated as instructions for tailoring the resume and cover letter, creating a vulnerability where a malicious job posting could influence the agent's behavior (e.g., instructing the agent to exfiltrate profile data via outreach channels).
Ingestion points: Job descriptions extracted via Playwright from user-provided URLs or search results.
Boundary markers: The skill documentation mentions treating JDs as untrusted, but lacks specific technical delimiters to prevent the LLM from obeying instructions embedded within the text.
Capability inventory: File read/write, WebSearch, and browser automation (navigating, clicking, typing, and submitting forms).
Sanitization: Claims to treat JD content as text only, but the nature of tailoring requires the LLM to process the meaning of the JD text.
[EXTERNAL_DOWNLOADS]: The install.sh script downloads several markdown files and templates from a remote GitHub repository (theaayushstha1/job-applier-agent) to the user's local machine and the agent's skill directory using curl.
[DYNAMIC_EXECUTION]: The workflow for resume tailoring involves the agent copying a base Python script (create_resume.py) and modifying its text content before execution. While the skill includes constraints against modifying functions, it relies on the agent's adherence to these rules while generating and running code.

apply-job