The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions read API keys and base URLs from the ~/.gooseworks/credentials.json file located on the local filesystem. This is used to authenticate requests to the Gooseworks API.
[COMMAND_EXECUTION]: The skill uses python3 for inline JSON parsing of credential files and curl to perform network operations, such as searching for jobs and retrieving company information.
[EXTERNAL_DOWNLOADS]: The skill instructions include running npx gooseworks login and npx goose-skills install, which involve downloading and executing Node.js packages from the npm registry.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it retrieves and processes unstructured data from external job search and company intelligence APIs.
Ingestion points: Data enters the agent context through the results of the Fiber, Brand.dev, and Hunter API calls proxying through api.gooseworks.ai.
Boundary markers: There are no markers or specific instructions to the agent to treat the external API responses as untrusted data or to ignore embedded instructions.
Capability inventory: The skill has access to shell command execution (curl, python3) and network access.
Sanitization: No validation or sanitization is performed on the data returned from the external APIs before it is interpreted by the agent.

job-search