The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands via Python scripts (e.g., manage_orchestration_ledger.py, manage_markdown_site.py) to manage its internal ledger and build markdown outputs. These commands interpolate user-provided strings such as the "plain-language outcome" and "authorized-boundary" directly into shell arguments, which could lead to command injection if the agent does not properly escape the input.
[DYNAMIC_EXECUTION]: The skill determines the location of its executable scripts at runtime by reading the .seo-suite-runtime.json file or environment variables like ${CLAUDE_PLUGIN_ROOT}. It then executes logic from these computed paths, which is a form of dynamic execution of local code.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an orchestrator that ingests untrusted data from external websites, repositories, and user goals to perform SEO audits and generate content. This creates a surface for indirect prompt injection attacks where malicious instructions hidden in a website's content or metadata could influence the agent's behavior during the audit.
Ingestion points: Site context discovery, repository inspections, and user-provided plain-language goals documented in SKILL.md and autonomous-orchestration-contract.md.
Boundary markers: The skill employs semantic and formal validators (e.g., manage_orchestration_ledger.py validate) and uses structured JSON schemas for data exchange, which helps mitigate but does not eliminate injection risks.
Capability inventory: The skill has broad capabilities including subprocess execution via Python, file system writes for markdown generation, and data normalization across multiple specialist modules.
Sanitization: While the skill uses formal schemas and verification gates, it does not explicitly describe sanitization or escaping of the ingested natural language content before processing.

seo