The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from external job descriptions and resumes to influence its output content and tailoring strategies without explicit sanitization or boundary markers.
Ingestion points: Job descriptions are fetched from arbitrary user-provided URLs in SKILL.md (Stage 0) using WebFetch, and resume content is read from provided file paths.
Boundary markers: Although a subagent is used in Stage 1 for initial analysis, no specific delimiters or instructions to ignore embedded commands are used when this untrusted content is passed into the main agent context for final resume drafting.
Capability inventory: The skill has file-write access to docs/resume/, network-read access via WebFetch, and shell execution capability via the weasyprint command.
Sanitization: There is no evidence of sanitization, escaping, or schema validation for the job descriptions or resume text before they are used to generate content or construct shell commands.
[COMMAND_EXECUTION]: In Stage 6.2, the skill constructs and executes a shell command using uv run weasyprint which incorporates variables like [slug], [Name], and [TargetRole]. These variables are derived from the untrusted job description and resume. Without strict escaping, this pattern could lead to command injection if malicious text is embedded in the job description or resume.
[EXTERNAL_DOWNLOADS]: The skill performs network operations via WebFetch to non-whitelisted domains to retrieve job descriptions. This behavior is intended for the primary skill purpose but remains a standard network security finding.

resume-tailor