The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to access and manage highly sensitive files stored in the user's home directory at ~/.claude/projects/{project-path}/credentials.env and ~/.claude/shared-credentials.env. These files contain plain-text API keys, database passwords, and authentication tokens, which constitute a high-value target for data exposure.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted input from users or external project configurations and treats them as credentials, creating a vulnerability surface for injection attacks.
Ingestion points: User-provided passwords, API keys, and tokens ingested via the vault's read and write procedures (SKILL.md).
Boundary markers: The instructions mandate masking sensitive values in console output and using double-quoted strings for file storage.
Capability inventory: The skill uses cat for reading secrets, a Write/Edit tool for modifying credential files, and chmod for permission management. It also facilitates using these credentials in shell commands (SKILL.md).
Sanitization: The skill provides logic for escaping special characters (", \, $) and warns that single quotes must be used in shell contexts to prevent payload interpretation, though it remains vulnerable to sophisticated injection payloads provided as "credentials."
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to interact with the filesystem, including cat for retrieving secrets, chmod 600 for hardening file permissions, and the execution of a local validation script (scripts/validate.sh).
[PERSISTENCE]: The skill establishes a persistence mechanism by storing long-lived authentication data in the hidden ~/.claude/ directory, which allows credentials to persist across agent sessions and projects.

credentials-vault