The Agent Skills Directory

[COMMAND_EXECUTION]: The Preamble section executes an external script check-update.sh located two levels above the skill's directory (../../check-update.sh). Executing scripts outside the skill's own package context is a risk as the integrity of the external script cannot be verified within this scope.
[DYNAMIC_EXECUTION]: The Subagent section instructs the agent to search for a script named anysearch_cli.py across multiple hidden application directories (such as ~/.claude/skills/anysearch/scripts/, ~/.cursor/skills/anysearch/scripts/, etc.). Once found, it executes the script using python3 <path> search. This pattern involves searching for and running arbitrary code found on the filesystem based on path discovery.
[REMOTE_CODE_EXECUTION]: While the skill does not explicitly download a payload from a URL, the combination of executing an external update script and searching the filesystem for other scripts to run creates a mechanism for executing code not defined within this specific skill's source.
[INDIRECT_PROMPT_INJECTION]: The skill leverages WebSearch and Exa tools to fetch market data and competitor information, which is then used to generate strategic reports and resource allocation suggestions.
Ingestion points: Data is ingested via mcp__exa__web_search_exa, mcp__exa__web_fetch_exa, and the WebSearch tool.
Boundary markers: The skill body lacks specific delimiters or instructions to the LLM to ignore potentially malicious instructions embedded in the retrieved web content.
Capability inventory: The skill possesses Bash, Write, and Agent (subagent) capabilities, which could be exploited if malicious instructions are processed from the web.
Sanitization: There is no evidence of sanitization or validation logic applied to the external data before it is used to influence the report generation or subsequent actions.

pm-portfolio