The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses python3 -c with a sophisticated inline script and sqlite3 to process local configuration files and databases. The Python script is designed to safely extract MCP server structures while redacting sensitive fields like environment variables, headers, full URLs (omitting query strings and credentials), and command-line arguments that appear to be secrets.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of memory notes (.md files) from other agents. These files could potentially contain malicious instructions or biased content.
Ingestion points: Reads MEMORY.md and associated Markdown files from $CLAUDE_HOME/projects/*/memory/ and $CODEX_HOME/memories/.
Boundary markers: The instructions do not specify using delimiters or "ignore instructions" wrappers when reading the content of these notes.
Capability inventory: The skill uses read_file, python3, sqlite3, add_memory, edit_memory, edit_file, and write_file.
Sanitization: The agent is instructed to review facts for truthfulness and rewrite references to the source agents, but there is no specific instruction to sanitize the Markdown content for embedded commands.
[DATA_EXFILTRATION]: The skill accesses sensitive user-level configuration files outside the workspace (e.g., ~/.claude.json, ~/.codex/config.toml, ~/.claude/settings.json). While these are sensitive paths, the skill implements strong protections, such as a mandate never to print secrets and a redaction script to ensure that sensitive data like tokens or passwords is not entered into the session log or displayed to the user without explicit pasting.

migrate