The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a Python script using a shell command constructed with variable interpolation: python "${CLAUDE_PLUGIN_ROOT}/scripts/intelligence-graph.py" --brand {slug} --action query-relevant --context '{context_json}' --min-confidence {threshold}.
Evidence: The {context_json} parameter is directly derived from user-supplied query context. The use of single quotes to wrap the variable is insufficient to prevent command injection if the input itself contains single quotes, potentially allowing an attacker to execute arbitrary shell commands.
[INDIRECT_PROMPT_INJECTION]: The skill processes and synthesizes data from external files and script outputs, creating a surface for indirect instructions to influence the agent.
Ingestion points: The agent reads ~/.claude-marketing/brands/_active-brand.json, ~/.claude-marketing/brands/{slug}/profile.json, and the output generated by intelligence-graph.py (SKILL.md).
Boundary markers: The instructions do not define any delimiters or provide guidance to the agent to ignore potentially malicious instructions embedded within the brand profiles or the intelligence graph results.
Capability inventory: The skill possesses the ability to execute shell commands (via Python script calls) and read from the local filesystem (SKILL.md).
Sanitization: There is no mention of sanitizing, escaping, or validating the external content before it is processed or presented in the final playbook output.

recall