The Agent Skills Directory

[COMMAND_EXECUTION]: The skill dynamically resolves the path to the plugin's internal script directory using shell command substitution: ${CLAUDE_PLUGIN_ROOT:-$(ls -td "$HOME"/.claude/plugins/cache/insight-wave/cogni-portfolio/*/ | head -1)}. This calculated path is then used to invoke scripts such as validate-taxonomy.sh, source-registry.sh, and sync-portfolio.sh via the Bash tool. This pattern of dynamic loading from computed paths is categorized as medium risk.
[PROMPT_INJECTION]: The skill ingests untrusted data from the public web to generate markdown reports and JSON data entities, presenting a surface for indirect prompt injection.
Ingestion points: Public company websites and documentation subdomains (e.g., docs.*, help.*) crawled by the portfolio-web-researcher subagent.
Boundary markers: The skill does not define explicit delimiters or instructions to ignore embedded commands within the processed web data.
Capability inventory: The skill is authorized to write and edit files (Write, Edit), execute shell scripts (Bash), and delegate work to subagents (Task).
Sanitization: Employs a 'description selection contract' that filters content based on taxonomy keywords and utilizes a deduplication agent to validate and merge discovered entities.

portfolio-scan