The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Python script team-manager.py located in the skill's root directory. It uses subprocess calls for multiple actions including listing team members, checking capacity, and creating assignments. The assign-task action passes a {task_json} payload directly to the script via a command-line argument, which could be a surface for argument injection if user-provided fields within the JSON are not properly escaped.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from various sources which could contain malicious instructions.
Ingestion points: Task descriptions, user notes, and external configuration files located in ~/.claude-marketing/brands/.
Boundary markers: The instructions do not define explicit boundary markers or delimiters to separate ingested data from the agent's system instructions.
Capability inventory: The skill has capabilities to read and write to the local file system (~/.claude-marketing/), execute a local Python script, and interact with Slack or Email through connected MCPs.
Sanitization: There is no mention of sanitization or validation logic for the user-provided notes or task descriptions before they are interpolated into the JSON payload or processed by the agent.

team-assign