The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Python script using shell command interpolation in the mandatory execution gate section.
Evidence: The skill calls python "${CLAUDE_PLUGIN_ROOT}/scripts/approval-manager.py" --brand {slug} --action create-approval --data '{"risk_level":"<tier>","summary":"..."}'. The interpolation of the {slug} and notification summary into the command line without explicit sanitization or parameterization poses a risk of command injection if the input contains shell metacharacters.
[DYNAMIC_EXECUTION]: The skill depends on the execution of an external script (approval-manager.py) located within the skill's root directory at runtime to handle business logic for approvals and logging.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection by ingesting configuration and guideline data from multiple local files.
Ingestion points: Loads active brand slugs and profiles from ~/.claude-marketing/brands/_active-brand.json, profile.json, _manifest.json, and agency SOPs from ~/.claude-marketing/sops/.
Capability inventory: The skill has the ability to execute shell commands via Python and send messages to external messaging platforms (Slack/Intercom).
Boundary markers: Absent. The process instructions do not include delimiters or warnings to ignore potentially malicious instructions embedded within the brand profiles or SOP files.
Sanitization: Absent. There is no evidence of validation or filtering for the content loaded from the local filesystem before it is used to influence agent behavior or formatted into notifications.

send-notification