The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a Python script using a path determined dynamically at runtime via shell commands: python3 "${WORKSPACE_PLUGIN_ROOT:-$(ls -td "$HOME"/.claude/plugins/cache/insight-wave/cogni-workspace/*/ | head -1)}/scripts/get-market-config.py". Using shell expansion and directory listing to resolve executable paths is a brittle pattern that can be exploited if the directory structure is manipulated.
[COMMAND_EXECUTION]: There is a potential for command injection in the execution of the market configuration script. The instruction specifies passing a <region-code> argument to the script; if this value is sourced from untrusted project files (like portfolio.json) without validation, it could allow for arbitrary shell command execution.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it ingests untrusted data from multiple local files and interpolates it into instructions for sub-agents without using boundary markers or delimiters.
Ingestion points: portfolio.json, markets/*.json, propositions/, competitors/, and context/context-index.json.
Boundary markers: Absent; the skill does not use delimiters or instructions to ignore embedded commands within the ingested data.
Capability inventory: The skill uses the Write tool to modify the filesystem and the Agent tool to perform web research and delegate tasks, providing a path for injected instructions to affect the system or external state.
Sanitization: No validation or escaping of the external content is performed before it is passed to the sub-agents.

customers