The Agent Skills Directory

[COMMAND_EXECUTION]: The Preamble section instructs the agent to execute a shell script using a relative path: bash "$(dirname "${BASH_SOURCE[0]}")/../../check-update.sh". This pattern depends on the skill's specific file system placement and can lead to unintended code execution if the environment is not strictly controlled.
[DYNAMIC_EXECUTION]: In Step 3.5, the skill defines prompts for sub-agents that include logic to search for a script named anysearch_cli.py across multiple hidden system directories (e.g., ~/.claude/skills/anysearch/scripts/, ~/.cursor/skills/anysearch/scripts/, ~/.anysearch/scripts/) and execute it using python3 via the Bash tool. This represents dynamic execution from computed paths found at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill collects product information, industry data, and pain points directly from the user via AskUserQuestion and interpolates these variables into complex prompts for three different sub-agents without any sanitization or boundary enforcement. This creates a surface where a malicious user could provide input designed to override the sub-agents' market research instructions.
Ingestion points: User inputs for PRODUCT_NAME, TARGET_USER, INDUSTRY, USER_PAIN_POINT, and VERIFIED_REQUIREMENTS collected in Step 1 and Step 2.
Boundary markers: Absent. The data is directly concatenated into the sub-agent prompt strings.
Capability inventory: Bash (used to execute found scripts), Agent (used to spawn sub-tasks), WebSearch, and Write (used to generate reports).
Sanitization: Absent. No validation, escaping, or filtering is applied to the user-provided data before it is sent to the sub-agents.

pm-demand