The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use shell commands such as mkdir -p and xclip -o > [filename] to manage files and capture clipboard content. Since the filenames are dynamically generated from external job titles and candidate names, this creates a command injection risk if these strings contain shell metacharacters (e.g., backticks, semicolons). The instructions suggest quoting paths for spaces but do not mandate robust sanitization.
[PERSISTENCE]: The skill documentation explicitly guides the user to set up cron scheduled tasks for periodic execution. Modifying system scheduling utilities like crontab is a standard persistence mechanism that allows a skill to execute repeatedly without manual intervention, which is a common pattern for maintaining long-term access in a target environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from a public recruitment platform (BOSS Zhipin) which could contain adversarial instructions designed to influence the agent's behavior during the scoring or summarization phases.
Ingestion points: Candidate resumes and Job Descriptions (JD) copied directly from the browser into the local file system (documented in SKILL.md).
Boundary markers: None identified. The content is treated as standard text data without delimiters or warnings to ignore embedded instructions.
Capability inventory: The agent has the ability to write to the file system, execute shell commands (via mkdir and xclip), and interact with external communication channels (Feishu/Lark) as described in SKILL.md.
Sanitization: The skill lacks instructions for sanitizing, escaping, or validating the external content before it is processed by the agent or saved to the disk.

byted-recruitment-bosszhipin-self-submission