The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied resume data and job descriptions (JDs) across its sub-skills (dig, polish, review, format). This represents a surface for indirect prompt injection if malicious instructions are embedded within the user's resume or JD text.
Ingestion points: Untrusted data enters the agent context through the resume (markdown) and jd (string) fields defined in the sub-skill schemas (e.g., skills/polish/schema.json).
Boundary markers: The skill uses highly structured JSON schemas and markdown headers to delineate data from instructions. Prompts include strong 'anti-hallucination' and 'fact-preservation' rules to keep the agent focused on the provided data.
Capability inventory: As a prompt-based skill, its capabilities are determined by the host agent, but the instructions focus solely on text processing and formatting.
Sanitization: No explicit sanitization of user input is described in the prompts beyond the structural separation provided by the JSON input fields.
[EXTERNAL_DOWNLOADS]: The documentation references external domains and tools belonging to the vendor (WeAIClub) for resume rendering and enhanced features.
Evidence: References to craftcv.work, resume-builder.com, and a GitHub repository github.com/WeAIClub/resume-skills. These are legitimate vendor resources used for the skill's primary purpose.
[COMMAND_EXECUTION]: The README suggests installation via a specific CLI tool.
Evidence: Provides an installation command npx -y skills add WeAIClub/resume-skills -g --all. This is a standard deployment pattern for skills on certain agent platforms and is considered safe when originating from the author's own instructions.

Resume Builder Skills