The Agent Skills Directory

[SAFE]: The skill's primary functionality is to analyze local transaction logs generated by previous agent activity. No security risks were identified.
[COMMAND_EXECUTION]: The skill uses allowed tools such as jq, cat, tail, mv, and gzip to query and rotate local log files. These operations are standard for the stated purpose of log management and data analysis.
[DATA_EXFILTRATION]: While the skill accesses ~/.claude/dd-guard/audit.jsonl which contains potentially sensitive habit data, there are no network operations (like curl or wget) to transmit this data externally. The skill documentation includes explicit instructions to respect user privacy and inform the user before accessing these logs.
[PROMPT_INJECTION]: The skill processes data stored in a JSONL file that contains logs of previous tool executions. While this is a surface for indirect prompt injection, the risk is minimized by the use of structured parsing with jq rather than interpreting the data as instructions. (Severity: SAFE)

doordash-order-ledger