The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run local Python scripts (campaign-tracker.py and benchmark_book.py) through shell commands. These calls use the {slug} variable, which could potentially be exploited for command injection if the brand identifier is not properly sanitized. This execution is found in SKILL.md and several reference files including contract-frameworks.md and influencer-discovery.md.- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from multiple external sources such as brand profiles and compliance rules to generate marketing plans and briefs. Ingestion points: The agent reads ~/.claude-marketing/brands/{slug}/profile.json, skills/context-engine/compliance-rules.md, skills/context-engine/industry-profiles.md, and ~/.claude-marketing/brands/{slug}/guidelines/_manifest.json. Boundary markers: No specific delimiters or warnings to ignore instructions within these files are provided. Capability inventory: The skill possesses the capability to execute local subprocesses via Python. Sanitization: No sanitization of the content read from these files is mentioned in the instructions.- [EXTERNAL_DOWNLOADS]: The skill framework includes an instruction for the agent to refresh marketing benchmarks by fetching content from external URLs and recording them using the benchmark_book.py script. This represents a mechanism for external data to be brought into the agent's environment.

influencer-creator