The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/ensure_ccusage.py uses npx ccusage@latest to execute an external tool. npx fetches the package from the NPM registry at runtime and executes it. Because the package is not pinned to a specific version and originates from an unverified third-party account, this represents a risk of executing malicious code updates.
[COMMAND_EXECUTION]: The skill invokes external binaries using subprocess.run in scripts/ensure_ccusage.py. While the command arguments are currently derived from internal logic (dates), the capability to execute shell commands increases the skill's overall attack surface.
[CREDENTIALS_UNSAFE]: The skill reads ~/.claude/settings.json and session transcripts from ~/.claude/projects/ and the Claude Desktop cowork directory. These files are highly sensitive as they contain full conversation history, project code, and potentially API keys for MCP servers or other integrations.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from session transcripts (scripts/jsonl_parser.py).
Ingestion points: Transcript files in ~/.claude/projects/ and cowork session directories.
Boundary markers: None implemented; the parser reads raw JSON lines.
Capability inventory: Includes shell command execution via subprocess.run for the audit baseline.
Sanitization: The parser extracts specific metadata (tool names, counts, usage stats) rather than interpreting or executing text content from the logs, which provides significant isolation from injection attacks.
[DYNAMIC_EXECUTION]: The script scripts/audit.py uses importlib.import_module to load detector logic at runtime. The modules are loaded from a hardcoded list within the script, ensuring only intended logic is executed.

token-audit