The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/render_pdf.mjs executes external Chromium or Google Chrome binaries using child_process.spawn to render resumes as PDF files.
Evidence: The script searches standard system paths and environment variables (CHROME_PATH) to locate browser executables and runs them with the --no-sandbox flag.
Mitigations: Filenames used in command execution are sanitized to prevent path traversal and shell injection.
[DYNAMIC_EXECUTION]: The skill dynamically generates HTML content from user-provided profile data, which is then written to the local filesystem and processed by a spawned renderer.
Evidence: scripts/build_resume.mjs assembles resume blocks into an HTML template at runtime before triggering the PDF conversion process.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from resumes (PDF, Word, or LinkedIn exports) and research findings aggregated from the web.
Ingestion Points: Data enters the system via the /kelly-jobhunt profile command and is imported through scripts/import_leads.mjs.
Boundary Markers: Instructional prompts guide the agent to perform factual extraction and use specific evidence markers to distinguish between official roles and aggregator data.
Capability Inventory: The skill possesses file-writing capabilities for resume generation and network access for SMTP email outreach.
Sanitization: The application implements HTML entity escaping in both the web interface and the resume typesetting logic to mitigate potential injection effects.

kelly-jobhunt