The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (IPI) because it fetches and processes untrusted data from the open web to identify job roles.
Ingestion points: Untrusted data enters the agent context via ATS API responses (Greenhouse, Lever, Ashby, Teamtailor) and through WebSearch or WebFetch of external company career pages as described in the 'How to Scan Each Company' section of SKILL.md.
Boundary markers: The instructions do not define boundary markers or delimiters to isolate external job description text from the agent's core instructions, increasing the risk that malicious text within a JD could be interpreted as a command.
Capability inventory: The skill has access to powerful tools including Bash, Write, and Edit, as listed in the allowed-tools frontmatter, which provides a significant attack surface if an injection occurs.
Sanitization: There is no mention of sanitizing, escaping, or validating the content retrieved from external sources before it is saved to the local file system or used in the 'Estimate fit' reasoning step.

scan-roles