The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to perform a shell execution in step 3 of the process: scripts/output-validator.py --action validate --text "{content}" --schema {schema_name_or_path}. Because the {content} variable is directly interpolated into the command string within double quotes, a malicious user or document could provide content containing shell metacharacters (e.g., backticks, $(...), or ;) to escape the quotes and execute arbitrary commands on the host system.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data for processing without sufficient security controls.
Ingestion points: User-provided content passed to the {content} variable in SKILL.md.
Boundary markers: None identified. The content is interpolated directly into instructions and shell commands without delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill can execute local python scripts (scripts/output-validator.py) and read files from the user's home directory (~/.claude-marketing/).
Sanitization: None mentioned. The skill does not describe any steps to escape shell characters or validate the structure of the input content before execution.
[DATA_EXFILTRATION]: The skill accesses sensitive local directories including ~/.claude-marketing/brands/ and ~/.claude-marketing/sops/. While this is intended for loading configuration, the combination of wide-ranging file access and the aforementioned command injection vulnerability creates a risk where brand profiles or agency SOPs could be read and exfiltrated if the execution environment is compromised.

validate-output