The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/sessions.sh reads sensitive Claude Desktop session metadata, including transcripts, titles, and working directories, from local application data paths: ~/Library/Application Support/Claude/claude-code-sessions (macOS), ~/.config/Claude/claude-code-sessions (Linux), and %APPDATA%\Claude\claude-code-sessions (Windows).
[DATA_EXFILTRATION]: The scripts/signal.sh utility includes logic to send branch and lane status to an external endpoint via the pigeon CLI tool, which is not a whitelisted or well-known service.
Evidence: pigeon send $(basename "$MAIN_REPO_ROOT") "lane $BRANCH $state" "Requesting land."
[PERSISTENCE]: The skill implements a background daemon process that remains active across the agent's interaction window to poll for state changes and automate git operations.
Evidence: fleet start in scripts/fleet.sh writes a PID to .claude/fleet/daemon.pid and executes a continuous while true polling loop.
[COMMAND_EXECUTION]: The skill facilitates the execution of arbitrary shell commands provided in the test_cmd configuration using the eval command.
Evidence: eval "$TEST_CMD" within a subshell in scripts/fleet.sh.
[OBFUSCATION]: scripts/fleet.sh uses URL/percent encoding to represent branch names in filenames, hiding the intent of state files from plain-text scanners.
Evidence: encode_lane() { local s=${1//\%/%25}; printf '%s' "${s//\//%2F}"; } in scripts/fleet.sh.
[METADATA_POISONING]: The skill author defined in the frontmatter (claude-mods) does not match the actual vendor context (0xdarkmatter), which may mislead users regarding the skill's origin.
[INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface where it ingests untrusted data that could influence the agent's behavior:
Ingestion points: Reads session titles and directory names from the Claude Desktop session store and branch notes from lane files.
Boundary markers: Lacks explicit delimiters or instructions to the agent to ignore instructions embedded in session metadata or lane notes.
Capability inventory: Arbitrary shell command execution, filesystem manipulation, and network communication via external CLI tools.
Sanitization: No sanitization is performed on session titles or notes before interpolation into agent views.
[DYNAMIC_EXECUTION]: The skill assembles and executes shell commands from local configuration strings at runtime via the eval function.

fleet-ops