The Agent Skills Directory

[DATA_EXFILTRATION]: Accesses sensitive personal information and document paths in the user's home directory.
The skill is designed to read from $HOME/.config/AgentDesk/private/job-applications/ to retrieve user identity, contact details, address, employment history, and paths to sensitive documents like resumes and transcripts.
This data is used to populate external web forms, creating a direct exposure path for personal and legal data.
[COMMAND_EXECUTION]: Executes browser automation tasks using external CLI tools and drivers.
Uses agent-browser CLI and Playwright MCP to interact with web pages, perform clicks, and fill inputs.
The skill can be instructed to perform an auto_submit_when_fully_answerable mode which performs autonomous actions on the web.
[PROMPT_INJECTION]: Vulnerable to indirect prompt injection from untrusted web content.
Ingestion points: The skill ingests data from job application forms and web labels from any URL provided to the agent (SKILL.md).
Boundary markers: There are no boundary markers or instructions to the agent to disregard instructions embedded in the external form labels or field descriptions.
Capability inventory: The agent has read access to sensitive local files (application-profile.yaml) and the ability to upload local files to the web via browser automation tools.
Sanitization: The skill lacks sanitization for labels or data extracted from external websites before the agent processes them as instructions for field classification.

job-application-operator