The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run a shell command (node ${CLAUDE_PLUGIN_ROOT}/src/prompt-coach.js) using user-provided text as a command-line argument. This pattern is vulnerable to command injection if the input contains shell-active characters.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user's prompt history and processes it using a high-privilege tool (Bash).
Ingestion points: User prompts and prompt history used in the analyze and improve commands in SKILL.md.
Boundary markers: The instructions tell the agent to place the text in double quotes (e.g., "the prompt text here"), which is insufficient to prevent injection if the user input includes double quotes, backticks, or subshell syntax (e.g., $(...)).
Capability inventory: The skill is granted Bash and Read permissions.
Sanitization: There are no instructions for the agent to sanitize, escape, or validate the user-supplied content before it is interpolated into the shell command.

cco-coach