The Agent Skills Directory

[COMMAND_EXECUTION]: The setup guide in SKILL.md describes the use of the Bash tool to clone repositories, install dependencies via npm, and initialize a Supabase database. These are documented steps for setting up the simulator's infrastructure and do not involve suspicious or obfuscated commands.
[EXTERNAL_DOWNLOADS]: The skill fetches the MediaPipe Face Mesh model from the JSDelivr CDN in references/proctor-engine-setup.md. MediaPipe is an established library from Google, and JSDelivr is a well-known technology service, making these downloads safe.
[PROMPT_INJECTION]: The references/session-orchestration.md file defines a DEBRIEF_PROMPT that interpolates the user's interview transcript directly into the coach's evaluation prompt. This creates a surface for indirect prompt injection where a candidate might attempt to manipulate their score.
Ingestion points: User transcripts are ingested into the debrief generator in references/session-orchestration.md.
Boundary markers: The transcript is interpolated without explicit delimiters or safety warnings in the DEBRIEF_PROMPT template.
Capability inventory: The skill uses Bash for environment setup, but the outputs of the debrief generator (structured JSON) are stored in a database and not executed as system commands.
Sanitization: The skill includes a truncateTranscript function, but it focuses on context window management rather than content sanitization.

interview-simulator