marketing-skills

This module is a straightforward A/B prompt evaluation harness with an optional, caller-controlled external command execution feature. The highest security risk is that --runner-cmd/payload['runner_cmd'] can be attacker-influenced and is interpolated with prompt/case_input before subprocess.run without allowlisting or robust sanitization, enabling arbitrary command execution under the script’s privileges. Separately, untrusted expected_regex patterns are executed via re.search and could cause performance degradation (ReDoS-like CPU spikes). No direct evidence of built-in malware (e.g., stealer/backdoor/network exfiltration) appears in this fragment; risk is primarily configuration-driven and depends on who controls runner_cmd/inputs.