The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill features an attack surface for indirect prompt injection because it is designed to ingest and analyze external, untrusted content such as user resumes and third-party job postings.
Ingestion points: The agent is instructed to audit resumes and read job postings provided by the user (as seen in the 'Portfolio audit' and 'Reading a job posting' sections of SKILL.md).
Boundary markers: There are no explicit instructions or delimiters defined to separate user-provided content from the agent's core instructions or to warn the agent against executing instructions contained within the external data.
Capability inventory: The skill does not request any dangerous tools or permissions (e.g., shell execution, file system modification beyond memory, or network access to sensitive domains) in its configuration, which minimizes the potential impact of an injection.
Sanitization: No input sanitization or validation routines are specified for the external text processing.
[PERSISTENCE]: The skill implements a session persistence mechanism by instructing the agent to store task and project context in a local file named devrel-context.md. This is a benign use of file storage to maintain state across different interactions and does not involve malicious persistence techniques like modifying shell profiles or system services.

devrel-career