The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill integrates with external data from Lever (applicants, jobs, applications) which represents an attack surface for indirect prompt injection if the external data contains malicious instructions targeted at the agent.
Ingestion points: Data is fetched via apideck.ats.applicants.list and similar methods in SKILL.md and processed by the agent.
Boundary markers: None explicitly defined in the provided TypeScript examples to separate external recruitment data from system instructions.
Capability inventory: The skill allows reading recruitment data and writing new applicant records to the Lever API.
Sanitization: Standard SDK patterns are used; however, explicit sanitization of external data strings is not demonstrated in the minimal examples.
[DATA_EXPOSURE_&_EXFILTRATION]: The skill uses environment variables (process.env.APIDECK_API_KEY) for secret management, which is a secure practice to prevent hardcoded credential exposure.
[EXTERNAL_DOWNLOADS]: The skill references official vendor resources and the @apideck/unify library, which are legitimate dependencies for the integration's intended purpose.

lever