The Agent Skills Directory

[DATA_EXFILTRATION]: The skill scans highly sensitive local files and directories as its primary auditing function.
It accesses session transcript logs in paths like ~/.claude*, ~/.codex*, and ~/.grok* to analyze conversation history.
It inspects security-critical paths such as ~/.ssh, ~/.aws, and .env files to check for protective deny rules.
It reads configuration settings from settings.json, config.toml, and crontab entries.
Mitigation: The skill implementation in extract.py and config_scan.py redacts prompt text and credentials, hashes project identities, and only exposes aggregated metrics to the agent context. Output is constrained to a local directory verified to be outside any git repositories by safe_output.py.
[COMMAND_EXECUTION]: The skill uses multiple internal and external command execution paths.
run_audit.py orchestrates the audit process by invoking sibling Python scripts via subprocess.run.
consensus.py executes model CLI binaries (claude, codex, grok, gemini) to perform multi-model verification of extracted practices.
Mitigation: Command execution for model verification includes isolation flags (e.g., --sandbox read-only, --setting-sources local) where supported to prevent sub-processes from accessing user configuration or MCP servers.
[EXTERNAL_DOWNLOADS]: The skill fetches documentation from a hardcoded allowlist of official vendor domains, including anthropic.com, openai.com, google.dev, cursor.com, and x.ai, to refresh its practice list.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from two main vectors which could theoretically influence the auditing agent's behavior.
Ingestion Points: Conversation logs (sessions.jsonl) and external web documentation pages.
Boundary Markers: The model verification prompt (verify-prompt.md) uses <<<CANDIDATES and <<<SOURCE delimiters to isolate instructions from data.
Capability Inventory: Shell command execution via subprocess and dynamic loading using importlib.
Sanitization: Log data is heavily distilled into metrics before reaching the agent. External verification results are validated against a strict JSON schema and verified across multiple independent model calls.
[DYNAMIC_EXECUTION]: The skill performs dynamic module loading in run_audit.py using importlib.util to access functionality from extract.py. It also dynamically constructs CLI commands for model verifiers based on the available flags in the installed versions of those tools.

agent-practice-audit