The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands that interpolate unvalidated user input directly into command-line arguments.
Evidence: In SKILL.md, Process Step 2 executes python "${CLAUDE_PLUGIN_ROOT}/scripts/language-router.py" --action detect --text "{content_or_path}". Step 6 and Step 9 perform similar interpolations using {source_content}, {translated_content}, and {content_or_path}.
Risk: If a user provides input containing shell metacharacters (such as ;, `, or $(...)), it could lead to arbitrary command execution on the host machine. While the placeholders are double-quoted, this does not guarantee protection against all shell injection vectors depending on the underlying execution environment.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a high-risk surface for indirect prompt injection by processing untrusted data and feeding it into subprocess calls.
Ingestion points: Untrusted content is ingested via the {content_or_path} variable in Step 2 and subsequent steps.
Boundary markers: The skill does not use any boundary markers or instructions to the agent to treat the interpolated content as data rather than potential commands or instructions.
Capability inventory: The skill has access to the local file system (specifically ~/.claude-marketing/) and the ability to execute subprocesses via the shell.
Sanitization: No sanitization, escaping, or validation logic is defined for the input content before it is passed to the shell commands.

translate-content