The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Behavioral signals and customer segment data are pulled from connected CRM MCPs (Salesforce, HubSpot), user-provided exports, and local brand configuration files located at ~/.claude-marketing/brands/.
Boundary markers: No explicit delimiters or "ignore embedded instructions" warnings are documented to separate the external data from the skill's operational instructions.
Capability inventory: The skill executes a Python script (churn-predictor.py) and interacts with CRM APIs via the crm-manager agent.
Sanitization: The instructions do not specify any validation, escaping, or filtering of the external signals before they are interpolated into the scoring process.
[DYNAMIC_EXECUTION]: The skill executes a local Python script using command-line arguments constructed from external, potentially untrusted data.
Evidence: The process in SKILL.md (Step 3) invokes python "${CLAUDE_PLUGIN_ROOT}/scripts/churn-predictor.py" --brand {slug} --action score-segment --segment-name {name} --signals '{...behavioral signals...}'.
Pattern: The interpolation of behavioral signals directly into shell arguments for a script execution represents a dynamic execution surface. While the script is part of the skill package, the inputs used to build the command line are derived from external CRM data or user inputs.

churn-risk