The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes several local scripts and binaries (rmbc-update-check, rmbc-analytics, and rmbc-workspace) for lifecycle management and telemetry. While these appear to be part of the skill's infrastructure, they run with the user's local permissions.
[COMMAND_EXECUTION]: A command injection vulnerability exists in the workspace setup logic. The skill takes the user's freeform text input for a product name and interpolates it directly into a shell command: ~/.claude/skills/dtc-copywriting-skills/bin/rmbc-workspace active "<user's answer>". If a user provides input containing shell metacharacters (e.g., "; command; #), arbitrary commands could be executed.
[DATA_EXFILTRATION]: The skill initiates a background telemetry process (rmbc-analytics) to log usage data, including the skill name and active product name. Although the skill documentation claims data stays on the machine, the underlying script is responsible for the network operations.
[EXTERNAL_DOWNLOADS]: The skill triggers the open command to launch a browser targeting a YouTube URL (https://www.youtube.com/watch?v=zI8tNfefH1M) for educational content.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted user data (product_description, target_audience) without visible boundary markers or sanitization. This could be used to influence the agent's behavior during the generation phase.
Ingestion points: Inputs such as product_description, target_audience, and key_mechanism in SKILL.md.
Boundary markers: None identified.
Capability inventory: Shell execution (open, sed, mkdir), file writing, and local script execution.
Sanitization: No input validation or escaping mechanisms are defined in the instructions.

fb-ad-copy