The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill is designed to check for the presence of secrets in ~/.claude-marketing/brands/{brand}/credentials.json and environment variables. Although it contains instructions to redact credentials from output, the capability to access and process private keys and tokens is a high-sensitivity operation.
[COMMAND_EXECUTION]: The skill executes multiple shell commands (test, jq, curl) and internal Python scripts (connector-status.py, resolve_model.py) by interpolating variables like {brand} and {url}. This pattern can be exploited if the inputs are not strictly sanitized.
[DATA_EXFILTRATION]: The skill uses curl to perform reachability checks against URLs defined in .mcp.json. If an attacker gains control over this local configuration file, they could direct the agent to send requests to malicious external servers, potentially serving as a vector for data leakage.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface where instructions or malicious payloads could be embedded in data it processes.
Ingestion points: Reads brand metadata and server URLs from profile.json and .mcp.json (SKILL.md Step 1 and Step 4).
Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore or sanitize embedded instructions within these data files.
Capability inventory: The skill utilizes Bash, Read, and Grep tools to execute commands like curl, jq, and shell tests, providing significant system access (SKILL.md Step 4 and Step 5).
Sanitization: No evidence of validation, escaping, or filtering of the content from the JSON configuration files before it is interpolated into shell command strings.

validate-profile