The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to automatically scan local project files (such as README.md, CLAUDE.md, and package.json) to infer a brand naming brief. This creates a surface for indirect prompt injection if these files contain malicious instructions meant to subvert the agent's behavior.
Ingestion points: Automated scanning of README.md, CLAUDE.md, package.json, pyproject.toml, Cargo.toml, and other manifest files in the project directory.
Boundary markers: No specific boundary markers or instructions to ignore embedded commands are defined for the file scanning process, though the skill does ask for user confirmation of the inferred brief.
Capability inventory: The skill executes a local Python script via shell commands and uses the Playwright browser tool to access external trademark databases.
Sanitization: The skill does not specify sanitization or validation steps for the content extracted from project files before it is used to drive subsequent automated steps.
[COMMAND_EXECUTION]: The workflow involves executing a local Python script (domain_checker.py) using names generated by the LLM as command-line arguments.
Evidence: The workflow in SKILL.md (Step 3b) explicitly instructs the agent to run python "${CLAUDE_PLUGIN_ROOT}/skills/domain-hunter/scripts/domain_checker.py" name1 name2 --tlds .com,.io.
Risk: If the naming generation is influenced by malicious content in project files, there is a potential for command injection if the agent does not properly escape the generated names before passing them to the shell.
[DYNAMIC_EXECUTION]: The skill provides instructions to use Playwright browser tools to interact with external trademark databases.
Evidence: Step 5 of the workflow instructs the agent to open and interact with the EUIPO TMview, USPTO Trademark Search, and WIPO Global Brand Database via a real browser.
Context: The skill fetches information from well-known official registers (e.g., tmdn.org, tmsearch.uspto.gov, and branddb.wipo.int) to perform trademark pre-screening.

brand-naming-method