The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8).
Ingestion points: The Review text input field accepts untrusted data provided by the user or fetched from external review platforms.
Boundary markers: The process instructions do not specify the use of delimiters (like XML tags or triple quotes) or explicit instructions to the agent to ignore embedded commands within the review text.
Capability inventory: Across its scripts and processes, the skill performs file reads from ~/.claude-marketing/ to load brand context and SOPs. No network operations, subprocess executions, or file-write capabilities were detected.
Sanitization: There is no evidence of input validation, escaping, or filtering for the external review content before it is processed by the agents.
[DATA_EXPOSURE]: The skill accesses local files located in the user's home directory.
It reads from paths such as ~/.claude-marketing/brands/, ~/.claude-marketing/sops/, and ~/.claude-marketing/brands/{slug}/profile.json. While this is aligned with the skill's purpose of brand-specific response generation, it represents a surface for accessing potentially sensitive organizational data stored on the filesystem.

review-response