The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file contains instructions for the agent to execute shell commands using bash and python3 to run included scripts (scripts/collect.sh and scripts/usage.py) for repository fact collection and usage analysis.
[DATA_EXFILTRATION]: The skill accesses and processes sensitive directories and files to generate audit reports. Specifically:
scripts/usage.py reads and parses session transcripts located in ~/.claude/projects/, which contain the full history of user interactions and agent responses.
scripts/collect.sh performs recursive searches for sensitive file paths such as .env, .pem, .key, and files containing credentials or service.account.
[CREDENTIALS_UNSAFE]: The scripts/collect.sh file includes hardcoded regular expression patterns specifically designed to identify and extract sensitive credentials, including OpenAI API keys (sk-), Google API keys (AIza), and GitHub personal access tokens (ghp_).
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing external data from past session logs.
Ingestion points: scripts/usage.py reads all .jsonl session transcript files from the local metadata directory.
Boundary markers: The script does not implement specific delimiters or "ignore" instructions when parsing transcript content to prevent the agent from inadvertently executing instructions found in the logs.
Capability inventory: The skill can execute shell commands, read and write files within the project structure, and access global session history.
Sanitization: No filtering or sanitization is applied to the content extracted from the transcripts before it is processed by the agent.

system-audit