The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill dynamically modifies the Python search path (sys.path) at runtime to import helper modules such as icons. It determines the source directory using the BRAND_CONTENT_DESIGN_DIR environment variable or hardcoded fallback paths within the user's home directory (e.g., ~/.claude/plugins/marketplaces/camoa-skills/). This pattern of dynamic loading from computed paths represents a risk factor. The skill also provides Python code snippets for the agent to execute, performing environment-level tasks such as loading custom fonts from assets/fonts/, reading image files, and writing generated presentation files.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from several external sources:
Ingestion points: canvas-philosophy.md, brand-philosophy.md, and user-provided content outlines.
Boundary markers: Explicit delimiters or 'ignore' instructions are absent.
Capability inventory: The skill uses reportlab for PDF generation, writes to the filesystem (PDF/PPTX), and performs SVG conversion via cairosvg.
Sanitization: There is no evidence of input sanitization or filtering to prevent malicious instructions embedded in the design documents from influencing the agent's behavior.

visual-content