The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using bun and curl. In Workflows/CreateSalesPackage.md and Workflows/CreateVisual.md, a command is constructed as bun run ~/.claude/skills/art/Tools/Generate.ts incorporating a --prompt argument derived from processed documentation. This presents a risk of command injection if the input content contains shell metacharacters or escape sequences, as no sanitization step is prescribed.
[COMMAND_EXECUTION]: The SKILL.md file mandates the execution of a curl command to http://localhost:31337/notify upon invocation to send voice notifications. While targeting localhost, this involves triggering network activity and shell execution as a side effect of loading the skill.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8). It ingests untrusted data from product documentation, technical specifications, and external URLs, which are then interpolated into instructions for secondary skills (StoryExplanation, Art) and CLI tools. The workflow lacks explicit boundary markers or instructions to ignore embedded commands within the ingested content.
Ingestion points: Product documentation, feature specifications, and product page URLs (referenced in Workflows/CreateNarrative.md).
Boundary markers: None present in the workflow instructions.
Capability inventory: Shell execution (bun run, curl), file system access (~/.claude/), and network operations (localhost).
Sanitization: No escaping or validation of external content is defined before it is used in prompt construction or command arguments.
[DATA_EXFILTRATION]: The skill performs file system operations within the ~/.claude/ directory, including reading user-defined customizations and appending execution logs to ~/.claude/LIFEOS/MEMORY/SKILLS/execution.jsonl. While standard for this platform's environment, it represents persistent local data access and recording of agent activity.

Sales