The Agent Skills Directory

[COMMAND_EXECUTION]: Unsafe interpolation of external data into shell commands.\n
Evidence: In batch/batch-runner.sh, the url variable read from an external source is interpolated directly into a shell string (prompt="... URL: $url ...") which is then executed. This allows for arbitrary command execution via shell expansion (e.g., $(command)) if the input contains malicious payloads.\n
Similar patterns exist in batch/auto-generate.js and generate-main-cv.js, where company and role fields are interpolated into execSync calls.\n- [REMOTE_CODE_EXECUTION]: Self-updating logic from a remote repository.\n
Evidence: update-system.mjs fetches logic and scripts from https://github.com/santifer/career-ops.git and performs a git checkout to overwrite local files, followed by npm install. This mechanism allows the skill's behavior to be remotely modified by an untrusted source.\n- [INDIRECT_PROMPT_INJECTION]: Untrusted data ingestion surface with broad capabilities.\n
Ingestion points: scan.mjs and auto-pipeline.md fetch and process job descriptions from arbitrary external URLs.\n
Capability inventory: The skill has the ability to execute shell commands, read/write local files (including the user's CV), and perform network operations.\n
Boundary markers: Absent. There are no instructions or delimiters in the evaluation prompts to ignore or isolate instructions potentially embedded within the job description text.\n- [DYNAMIC_EXECUTION]: Runtime generation and execution of agent instructions.\n
Evidence: batch/batch-runner.sh dynamically generates a Markdown file (.resolved-prompt-${id}.md) and instructs the AI agent to execute it as a system prompt using the --append-system-prompt-file flag.\n- [EXTERNAL_DOWNLOADS]: Fetches updates and environment configuration from external sources.\n
Evidence: The skill performs network requests to GitHub for updates in update-system.mjs and downloads environment configuration from the Nix community repository in .envrc.

career-ops