The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses direct interpolation of user-supplied arguments into its core prompt without safety delimiters.
Evidence: The variable $ARGUMENTS is placed directly under the TARGET: header without markdown blocks or XML tags to isolate it from the instruction set, making it susceptible to direct prompt injection attacks.
[DATA_EXFILTRATION]: The skill's primary function involves reading and analyzing potentially sensitive data structures, creating a risk of data exposure.
Evidence: Phase 1.2 (Matching Data Model) instructs the agent to read candidate profiles, employer profiles, and match records which likely contain PII (Personally Identifiable Information) or sensitive business data.
Ingestion points: Codebase files, package manifests, and database configurations scanned in Phase 1.1.
Boundary markers: None present to distinguish between untrusted code/data and the skill's instructions.
Capability inventory: File read access and the ability to write reports to the docs/ directory.
Sanitization: No explicit instructions are provided to sanitize or filter sensitive data before it is processed by the LLM context.
[COMMAND_EXECUTION]: The skill contains logic for automated file system interaction outside of its immediate directory.
Evidence: The 'Self-Evolution Telemetry' section directs the agent to locate ~/.claude/projects/ and append execution metadata to skill-telemetry.md, representing an automated side-effect involving file discovery and write operations.

employer-matching