The Agent Skills Directory

[DATA_EXFILTRATION]: The Python utility scripts/landing_page_scaffolder.py opens a file path specified by the args.input argument without validating that the path is within the current workspace or a safe directory. This allows for arbitrary file reading (restricted to JSON parsing) and could expose sensitive local configuration data.
[COMMAND_EXECUTION]: Instructions in SKILL.md (Generation Workflow Step 2) direct the agent to execute a Python script at an external relative path (marketing-skill/content-production/scripts/brand_voice_analyzer.py). This is a command execution pattern that relies on scripts not contained within the skill's own package, posing a risk of executing unverified code if that path is controlled by a malicious actor.
[PROMPT_INJECTION]: The skill metadata makes a self-authoritative claim (risk: "safe") that should be disregarded during safety evaluation. Furthermore, the instructions process untrusted user-provided content without clear boundary markers, creating an attack surface for indirect prompt injection. Evidence Chain: 1. Ingestion points: Brand content processed in Step 2 of SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: File-write operations via landing_page_scaffolder.py. 4. Sanitization: Present (the scaffolder script uses html.escape and json.dumps for generated content).

landing-page-generator