The Agent Skills Directory

[COMMAND_EXECUTION]: The skill dynamically constructs shell commands by interpolating variables like {TOKEN}, {CHAT_ID}, and MESSAGE into a single-quoted curl command string within Step 8 and Step 4a. Because MESSAGE can contain untrusted text from external sources (such as job metadata or user text), any single quote or shell metacharacter present in the data can break out of the single-quoted shell literal, leading to arbitrary command execution on the host machine.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted inputs with extensive privileges:
Ingestion points: Untrusted data enters the context in SKILL.md at Step 2 through the Telegram API getUpdates polling method.
Boundary markers: Absent; there are no delimiters or defensive prompts configured to isolate untrusted text from instruction blocks.
Capability inventory: The skill holds wide capabilities in SKILL.md, including file modifications (Read, Write, Edit), shell execution via the Bash tool, and complete browser control via the mcp__claude-in-chrome__* suite.
Sanitization: Absent; incoming chat messages are handled and routed to downstream workflows without any escaping, filtering, or validation.

jobsearch-telegram