The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/jd_parser.py file contains a call to subprocess.run() to execute the pdftotext CLI utility. This is used as a standard fallback mechanism for extracting text from PDF files and does not present an arbitrary command execution risk in the context of the skill's functionality.
[EXTERNAL_DOWNLOADS]: The skill utilizes WebFetch and WebSearch permissions to retrieve Job Description (JD) content from user-provided URLs and to perform market research for interview preparation. These actions are transparent and necessary for the skill's stated purpose of tailoring resumes to specific job requirements.
[PROMPT_INJECTION]: The skill includes a robust 'Fabrication Gate' and 'Sincerity Auditor' node. These mechanisms are specifically instructed to detect and block user attempts to generate fake work experiences or override safety constraints, demonstrating a security-conscious design against indirect prompt injection and output manipulation.
[DATA_EXPOSURE]: The skill performs local file read and write operations to manage resume files and session snapshots. Access is restricted to the user's workspace and intended for document management, with no evidence of sensitive data being exfiltrated to unauthorized domains.

baogong