The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests untrusted content from multiple project entities (propositions, features, products, markets, etc.) and incorporates this data into prompts for sub-agents.
Ingestion points: Data is read from JSON files in the propositions/, features/, products/, markets/, competitors/, and customers/ directories.
Boundary markers: The skill does not explicitly define delimiters or instructions to ignore embedded commands when passing this data to the solution-planner or solution-review-assessor agents.
Capability inventory: The agent has access to Bash, Write, Edit, and Agent tools, which could be leveraged if malicious instructions were successfully injected through the data files.
Sanitization: There is no evidence of content validation or escaping before the external data is interpolated into the agent's context.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute local utility scripts within the plugin's directory structure.
Evidence: It invokes scripts/project-status.sh using a dynamic path resolution logic: ${CLAUDE_PLUGIN_ROOT:-$(ls -td "$HOME"/.claude/plugins/cache/insight-wave/cogni-portfolio/*/ | head -1)}.
Context: This execution is intended for internal project management and relies on the standard location for plugin assets on the host platform.

solutions