The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Node.js script (resources/hire-scorecard.js) to process role configurations and candidate ratings. The script is bundled with the skill and performs calculations locally without network access or external dependencies.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied candidate names and interview evidence notes which are then displayed back to the agent. This represents an attack surface where malicious input could attempt to influence subsequent agent behavior.
Ingestion points: Candidate names, ratings, and interview evidence notes provided via the JSON configuration described in SKILL.md.
Boundary markers: Data is passed to the script in JSON format, providing structural separation; however, no specific delimiters or ignore-instructions warnings are defined for the final presentation of findings to the user/agent.
Capability inventory: The skill has the capability to execute local shell commands (node) and read local resource files (resources/kit-template.md).
Sanitization: The scoring script utilizes JSON.parse for structural integrity and validates that scores are numeric, but it does not perform sanitization or filtering of the text content within evidence notes for potential injection patterns.

first-marketing-hire