The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains strong behavioral instructions that urge the agent to override 'caution' and produce output regardless of thin inputs. Specifically, it states: 'Refusing to produce a draft is a failure of this skill, not caution.' While intended to ensure task completion, this language instructs the agent to bypass internal refusal mechanisms.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external URLs (via WebFetch) and user-supplied files (via Read) and writes this data into context files stored in the knowledge/ directory. This creates a surface where malicious instructions in external sources could influence the behavior of other marketing skills that read these files.
Ingestion points: External website URLs (Mode 2) and local files/folders (Mode 2) via WebFetch and Read tools.
Boundary markers: The skill uses template placeholders like [TEMPLATE], [NEEDS INPUT], and [UNVERIFIED] to distinguish drafted content, but lacks explicit security boundaries for raw external content.
Capability inventory: The skill uses cp (shell command) to initialize directories and writes markdown files to the local filesystem (knowledge/ subfolders).
Sanitization: There is no explicit sanitization of content fetched from external URLs before it is drafted into the brand context files, though user review is required before final writing.
[COMMAND_EXECUTION]: The instructions direct the agent to execute a shell command cp -r ${CLAUDE_SKILL_DIR}/assets/knowledge ./knowledge to initialize the project structure. While this is a local utility function for project setup, it involves direct shell interaction.

brand-context