The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes node and npm to execute local scripts within the repository, such as build-asu-resume.mjs, inline-template.mjs, and export-resume-pdf.mjs. These scripts perform tasks like inlining CSS/JS into the HTML resume and exporting the final document to PDF using a headless browser (Edge/Chrome).
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data provided by the user, including personal details, work history, and project descriptions. This content is interpolated into HTML templates to generate a personalized resume, which creates an attack surface if the user-provided text contains malicious HTML or script tags.
Ingestion points: User messages, document attachments (PDFs, images), and existing resume files (SKILL.md).
Boundary markers: The skill employs a placeholder system (e.g., 待补充) but does not explicitly detail sanitization or escaping of HTML/JavaScript within the user-supplied strings.
Capability inventory: The skill possesses the ability to write to the local filesystem and execute Node.js build scripts.
Sanitization: There is no specific description of sanitization procedures to prevent XSS or layout breakage from malicious user input during the generation of the final HTML resume.
[DYNAMIC_EXECUTION]: A JavaScript snippet is provided in references/page-balance-qa.md intended for manual execution in a browser console. This script programmatically measures the visual density, scroll height, and potential overflow of the generated resume sheets.
[EXTERNAL_DOWNLOADS]: The skill fetches brand logos and icons from LobeHub repositories (@lobehub/icons and @lobehub/icons-static-svg), which are well-known services used for professional resume aesthetics.

make-resume