The Agent Skills Directory

[SAFE]: No malicious patterns or security risks were identified. The skill performs legitimate analysis of local development tool history files to estimate session costs.
[DATA_EXFILTRATION]: The skill accesses local agent history directories (e.g., ~/.claude/projects, ~/.cursor/chats) to extract token usage and model metadata. This access is essential for its documented purpose and is not exfiltrated as the script contains no network-related code.
[COMMAND_EXECUTION]: The script uses subprocess.run to call git worktree list. The command is executed with a fixed list of arguments and does not use shell=True, preventing command injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-generated chat history logs which represent a potential attack surface. (1) Ingestion points: Local history files for Claude, Codex, and Cursor analyzed in scripts/cost.py. (2) Boundary markers: The SKILL.md instructions tell the agent to "Relay stdout as-is" and specify that the output is a Markdown report, not instructions. (3) Capability inventory: The skill is limited to reading history, executing git, and writing a Markdown report to a local temp file. (4) Sanitization: The clean_user_text function in scripts/cost.py uses regular expressions to strip specific system tags and metadata from user messages before inclusion in the report.

melech-cost