The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script (campaign-tracker.py) using a shell command. This command incorporates a variable ({slug}) into its arguments without proper quoting or sanitization, creating a surface for potential command injection if the variable content is maliciously crafted.
[INDIRECT_PROMPT_INJECTION]: The skill's architecture is vulnerable to indirect prompt injection due to how it handles untrusted data:
Ingestion points: The agent reads brand-specific data (profiles, guidelines, and history) from the local file system (~/.claude-marketing/brands/) and processes external queries from journalist platforms like Qwoted and Featured.
Boundary markers: The instructions do not define any delimiters or provide warnings to the agent to ignore instructions that might be embedded within the brand files or external journalist queries.
Capability inventory: The skill allows the agent to execute shell commands and create documentation, which could be leveraged if an attacker successfully injects instructions into the data sources.
Sanitization: There is no mention of sanitizing or validating the contents of the files or external requests before they are used to guide the agent's actions.

digital-pr