The Agent Skills Directory

[PROMPT_INJECTION]: The skill's primary function is processing untrusted data (Gmail messages), creating a significant risk for indirect prompt injection. Maliciously crafted emails could attempt to override the agent's instructions during the parsing phase. While OPERATING_CARD.md includes a rule to stop on detection of injection text, this relies on the model's self-detection capability.
[COMMAND_EXECUTION]: The script scripts/update_application_status.py uses subprocess.run() to execute auxiliary scripts like mirror_to_sqlite.py and log_outcome.py. The arguments passed to these scripts (e.g., company names, roles, and outcomes) are derived from the agent's interpretation of external email content.
[COMMAND_EXECUTION]: The OPERATING_CARD.md specifies that the agent should 'Commit + push tracker after every 10 status changes'. This grants the agent autonomy to perform network-based Git operations, which could be leveraged for data exfiltration if the tracker content is manipulated via injection.
[DYNAMIC_EXECUTION]: The script scripts/update_application_status.py reads JSON state files from /tmp/apply_pipeline/run_state.json and /tmp/fa_run_state.json to determine 'predicted confidence'. If an attacker on the same system can write to these shared temporary paths, they could influence the agent's decision-making logic.

gmail-application-refresh