The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from Job Descriptions and CVs across multiple analysis phases, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: JD_TEXT (collected via text, file, or WebFetch URL) and CV_TEXT (text or file) as defined in SKILL.md.
Boundary markers: The skill instructions do not implement explicit delimiters or instructions to ignore embedded content when passing external text to the subagents (cv-job-decoder, cv-progression).
Capability inventory: The workflow includes the ability to create and update Google Docs (mcp__google-workspace__create_doc, mcp__google-workspace__batch_update_doc) and fetch content from the web using WebFetch.
Sanitization: There is no evidence of sanitization or filtering applied to the input text before it is interpolated into analysis prompts.
[EXTERNAL_DOWNLOADS]: The skill documentation includes an installation command that references the author's GitHub repository (github.com/peter-tu-zynkr/zynkr-skill-builder). This is identified as a vendor-owned resource.

cv-customizer