The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Bash to execute a local Python script (get-market-config.py) to extract and aggregate market data. The script is part of the vendor's existing toolset in the cogni-workspace directory. Additionally, the path to this script is resolved dynamically at runtime using shell command substitution (ls -td) and environment variables, which is a standard pattern for locating internal tools in the plugin cache.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes and renders data from multiple external configuration files into its output.
Ingestion points: Reads data from supported-markets-registry.json, market-sources.json, and region-authority-sources.json (SKILL.md).
Boundary markers: Content from these JSON files is interpolated directly into a markdown table without explicit delimiters or instructions to ignore embedded agent commands.
Capability inventory: The skill possesses file system access (Read, Glob, Grep) and shell execution capabilities (Bash), though used here for read-only aggregation (SKILL.md).
Sanitization: No validation or escaping of the ingested JSON metadata is performed before it is rendered to stdout.

audit-region-sources