The Agent Skills Directory

[DATA_EXPOSURE]: The skill accesses session transcripts located in ~/.claude/projects/. These files contain logs of previous interactions and tool usage across all of the user's projects, which may contain sensitive information.
[COMMAND_EXECUTION]: The skill modifies the .claude/settings.json file to add command patterns to the permissions.allow list. This action reduces the security boundary by bypassing future user confirmation prompts for the specified shell and MCP tools.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from historical transcripts to determine security policy. While it contains logic to filter for read-only commands and exclude interpreters/shells, a malicious command captured in the transcript history could theoretically influence the agent to suggest an unsafe allowlist entry.
Ingestion points: Reads *.jsonl files from ~/.claude/projects/ (Step 1).
Boundary markers: Not explicitly defined for the read process.
Capability inventory: File reading (cat/read) and file writing (merging into .claude/settings.json).
Sanitization: Step 3 and 4 provide extensive lists of banned commands (interpreters, shells, package runners, mutators) and auto-allowed defaults to guide the agent's filtering logic.

fewer-permission-prompts