The Agent Skills Directory

[DATA_EXFILTRATION]: The skill uses relative path traversal (../../references/CAMPAIGN_BRAND.md) to access files two levels above its own directory. While the target file appears to be a legitimate project reference, accessing files outside the skill's root directory is a practice that can be misused to access sensitive environment configurations or files if the path is manipulated.
[COMMAND_EXECUTION]: The skill instructions include the execution of a local Python script (scripts/campaign_content.py) using the command line with variable project arguments.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external data from multiple sources to define branding rules, creating a vulnerability to malicious instructions embedded in those sources.
Ingestion points: Reads from ../../references/CAMPAIGN_BRAND.md, campaign state, canon, verified release facts, and approved writing samples (as noted in SKILL.md).
Boundary markers: The instructions lack explicit boundary markers or XML-style delimiters to separate external data from the agent's core instructions, nor do they include warnings to ignore instructions embedded within the ingested content.
Capability inventory: The skill possesses the ability to write files to the local system (06_release/social/brand_voice.json) and execute shell scripts (scripts/campaign_content.py).
Sanitization: No sanitization, filtering, or validation steps are defined for the ingested text before it is used to influence the agent's behavior or passed to the validation script.

campaign-brand