The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a shell command scripts/output-validator.py --action validate --text "{content}" --schema {builtin_schema_name} where the {content} variable is directly interpolated from user input. An attacker can provide content containing shell metacharacters (e.g., ;, &&, |, `) to execute arbitrary commands on the host system.
[DATA_EXFILTRATION]: The process allows users to provide a file path to a custom JSON schema which is then passed to the command line via the --custom-schema {path/to/schema.json} flag. This allows an attacker to perform path traversal or read sensitive system files (e.g., /etc/passwd or SSH keys) by pointing the validator to those locations.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection.
Ingestion points: The skill ingests untrusted data through the "Content to validate" input (provided inline, pasted, or via file path) and the "Schema file" path.
Boundary markers: There are no mentioned boundary markers or instructions to the agent to treat the {content} variable as untrusted data when interpolating it into shell commands.
Capability inventory: The skill has the capability to execute a Python script (scripts/output-validator.py) and read files from the user's home directory (~/.claude-marketing/).
Sanitization: There is no evidence of sanitization or escaping of the user-provided content before it is passed to the shell.

validate-output