The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md preamble contains instructions to execute telemetry/version_check.py and telemetry/telemetry_init.py. These files are not included in the 26 files provided in the skill package, which represents the execution of unverified local scripts.
[COMMAND_EXECUTION]: Several scripts, including scripts/editorial-brain.py and scripts/content-quality-gate.py, use subprocess.run to invoke system commands. Specifically, editorial-brain.py calls yt-dlp and ffmpeg with arguments derived from external YouTube URLs. While the script attempts to validate the video ID using a regular expression, the invocation of these high-capability tools remains a significant security surface.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a clear attack surface for indirect prompt injection across several components:
- Ingestion points: The skill fetches and processes untrusted data from YouTube transcripts (scripts/editorial-brain.py), RSS feed entries (scripts/quote-mining-engine.py), and external content drafts.
- Boundary markers: There are no protective boundary markers or instructions to the AI to ignore embedded commands within the processed data.
- Capability inventory: The agent possesses capabilities to execute shell commands (subprocess), write files, and perform network operations via the Anthropic API and urllib.
- Sanitization: The skill performs only basic formatting cleaning (e.g., removing HTML tags or extra whitespace) but does not escape or sanitize content before interpolating it directly into prompts (e.g., in scripts/content-transform.py: prompt = f"... SOURCE CONTENT: {clean_content(atom['content'])} ...").
[REMOTE_CODE_EXECUTION]: The skill is configured to run scripts at load-time via the SKILL.md preamble. The absence of these scripts (telemetry/version_check.py) prevents auditing of their behavior and makes the skill dependent on the presence of unverified files in the local environment.

expert-panel