The Agent Skills Directory

[COMMAND_EXECUTION]: The test suite (located in the tests/ directory) utilizes subprocess.run to execute and verify the skill's internal Python scripts during development and validation. These operations are restricted to the local environment and are used exclusively for testing the skill's CLI functionality.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from candidate resumes and job descriptions. It manages this attack surface by utilizing structured JSON schemas for all internal data objects and applying HTML escaping when rendering the final offline report.
[DATA_EXPOSURE_AND_EXFILTRATION]: While the skill processes sensitive candidate information, it includes robust safeguards. The generated HTML reports implement a strict Content Security Policy (connect-src 'none') and rely on local browser storage (localStorage) to ensure that candidate data and interview notes remain on the user's machine.
[DYNAMIC_EXECUTION]: The prepare_candidate_photo.py script performs deep structural validation of PNG files, including CRC checks and pixel layout verification, before embedding them as Base64 data URIs. This prevents the inclusion of malformed or malicious image data in the final report.

assess-interview-candidate