The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructions direct the agent to execute a local Python script by constructing a shell command string that directly interpolates variables like and . This pattern creates a risk of command injection if the input fields contain shell metacharacters such as backticks, semicolons, or pipe symbols. Evidence in SKILL.md: python3 "${CLAUDE_PLUGIN_ROOT}/scripts/connectors/ledger.py" record --source rank --data '{"": , ...}'.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze data from external search results, SEO tool exports, and AI visibility monitors. 1. Ingestion points: The agent context is populated with ranking data, SERP feature ownership, and AI citation content via the WebFetch tool or external files. 2. Boundary markers: The instructions do not specify the use of delimiters or clear separation between system instructions and untrusted data, which could allow malicious content in the fetched data to influence agent behavior. 3. Capability inventory: The agent has the ability to write to persistent memory files (memory/monitoring/ and memory/open-loops.md) and execute local scripts via shell commands. 4. Sanitization: There is no requirement or guidance in the instructions for sanitizing or validating the retrieved SEO data before processing or report generation.

rank-tracker