market-weather
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a Python script located at
${CLAUDE_PLUGIN_ROOT}/scripts/macro-signal-tracker.pyto generate the weather report. This is an execution of a local tool intended to be bundled with the skill package. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from several local files including brand profiles, guidelines, and SOPs which could serve as an attack surface if the content is adversarial.
- Ingestion points: Reads files from
~/.claude-marketing/brands/and~/.claude-marketing/sops/(SKILL.md, Step 1). - Boundary markers: None identified; instructions do not specify delimiters for the ingested file content.
- Capability inventory: Execution of shell commands (
python "${CLAUDE_PLUGIN_ROOT}/scripts/macro-signal-tracker.py" ...) (SKILL.md, Step 2). - Sanitization: No sanitization or validation of the file content is described before it is processed by the agent or passed to the script.
- [DATA_EXPOSURE]: The skill reads sensitive marketing information from the local filesystem, such as target markets, competitive sets, and internal brand guidelines, to provide contextual analysis.
Audit Metadata