The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command python "${CLAUDE_PLUGIN_ROOT}/scripts/execution-tracker.py" --brand {slug} --action get-history where {slug} is a user-provided variable. Without explicit sanitization, this allows for command injection if the user provides shell metacharacters (e.g., ;, &, |).
[COMMAND_EXECUTION]: File paths are constructed using user-controlled variables {category} and {sop-slug} (e.g., ~/.claude-marketing/sops/{category}/{sop-slug}.json). This pattern is vulnerable to path traversal attacks, potentially allowing the agent to read from or write to arbitrary locations on the filesystem if input like ../../ is used.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data and provides a surface for indirect prompt injection.
Ingestion points: Data is ingested from brand profile files (profile.json), execution history logs retrieved via a script, and direct user input for SOP content and overrides.
Boundary markers: None identified. There are no instructions to the agent to treat external content as data only or to ignore embedded instructions.
Capability inventory: The skill has the capability to write files to the local filesystem (~/.claude-marketing/sops/) and execute subprocesses (via execution-tracker.py).
Sanitization: No sanitization, escaping, or validation logic is specified for the interpolated content or brand/SOP identifiers.

sop-library