The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/build_tech_resume.py uses subprocess.run to call LibreOffice (soffice) for DOCX to PDF conversion. The command is executed using an argument list, which prevents shell injection.
[COMMAND_EXECUTION]: The script scripts/verify_resume.py executes system utilities pdfinfo and pdftotext via subprocess.run to validate the generated resume. These calls are also handled safely using argument lists.
[EXTERNAL_DOWNLOADS]: The scripts/verify_resume.py script performs network requests to verify the availability of URLs included in the resume. This is a legitimate functional requirement for resume verification.
[INDIRECT_PROMPT_INJECTION]: The skill extracts text from PDF files using pdftotext in scripts/verify_resume.py. While this presents a surface for indirect prompt injection if the PDF content contains malicious instructions, the script itself only performs substring checks and does not interpret the text as commands.
Ingestion points: scripts/verify_resume.py extracts text from the generated PDF file.
Boundary markers: No specific delimiters are used when processing the extracted text.
Capability inventory: Subprocess execution (PDF tools, LibreOffice) and network requests (URL validation).
Sanitization: None applied to the extracted PDF text; however, the text is only used for status checks and not re-executed.

chinese-ai-resume