The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local Python scripts by interpolating data directly into a shell command string. In step 4, the skill executes performance-monitor.py with an argument --data '{...current-period metrics...}' where the metrics are retrieved from external marketing platforms. In step 9, it executes campaign-tracker.py with generated insights passed via a JSON-like string in the --data argument. This pattern is highly susceptible to command injection if the data contains shell metacharacters such as backticks, semicolons, or pipes.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection through its ingestion of external marketing data.
Ingestion points: External metric data retrieved from Google Analytics, Google Ads, Meta, LinkedIn, and other connected platforms (SKILL.md, Step 2).
Boundary markers: No delimiters or safety instructions are defined to separate untrusted external data from the command context.
Capability inventory: Execution of subprocesses with data-driven arguments (Steps 4, 5, 9); network operations via MCPs (Step 2); and sensitive local file system access (Step 1).
Sanitization: There is no evidence of validation or escaping for the data being interpolated into shell commands.
[DATA_EXFILTRATION]: The skill reads sensitive local files from the user's home directory, specifically ~/.claude-marketing/brands/{slug}/profile.json and agency SOPs. While this is part of its functional requirement, the combination of sensitive data access with the capability to perform network operations through marketing MCPs creates a potential for data exfiltration.
[DYNAMIC_EXECUTION]: The skill's primary logic relies on the dynamic construction and execution of shell commands at runtime. The use of computed arguments derived from external sources represents a high-risk dynamic execution pattern.

anomaly-scan