The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly directs the agent to read configuration files such as ~/.claude/settings.json and /private/tmp/skillcap/.claude/settings.local.json. These files are standard locations for storing authentication tokens, API keys, and other sensitive platform credentials.
[DATA_EXFILTRATION]: The instructions require the agent to read session debug logs (~/.claude/debug/{{SESSION_ID}}.txt) and daemon logs (~/.claude/daemon.log). These files frequently contain environment variables, PII, and internal system state that could be exposed if the agent is manipulated.
[COMMAND_EXECUTION]: The skill specifies the use of grep to search for specific error and warning patterns across system files, which involves the execution of shell commands by the agent.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection:
Ingestion points: Reads external, untrusted content from debug logs (~/.claude/debug/*.txt) and background daemon logs.
Boundary markers: None. The skill does not instruct the agent to use delimiters or ignore instructions embedded within the logs.
Capability inventory: Includes file reading, shell command execution (grep), and subagent invocation (claude-code-guide).
Sanitization: None. Data from logs is processed directly to identify failure patterns, allowing malicious instructions in the logs to potentially influence the agent's summary or subsequent steps.

debug