The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local bash scripts (e.g., propagate-corrections.sh) using arguments derived from cogni-claims/claims.json. These claims are sourced from the web by research agents, creating a command injection vector if the claim text contains shell metacharacters.
Evidence found in SKILL.md (Step 8d): bash "${CLAUDE_PLUGIN_ROOT:-...}/scripts/propagate-corrections.sh" apply "<project-dir>" "<entity-file>" "<field-path>" "<corrected-value>".
[COMMAND_EXECUTION]: The skill uses dynamic path resolution via a subshell to locate its own scripts: $(ls -td "$HOME"/.claude/plugins/cache/insight-wave/cogni-portfolio/*/ | head -1). Executing code from paths computed at runtime is a risky pattern that can be exploited if the directory structure is manipulated.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection. It ingests untrusted data from the web (claims) and processes it with high-privilege capabilities (file-write and shell execution).
Ingestion points: Data enters through cogni-claims/claims.json which is populated by external research agents.
Boundary markers: No boundary markers or "ignore embedded instructions" warnings are used when processing claim content.
Capability inventory: The skill utilizes Read, Write, Edit, and bash subprocess calls across the project directory.
Sanitization: There is no evidence of sanitization, escaping, or validation of the web-sourced content before it is used in shell commands or interpolated into project JSON files.

portfolio-verify