The Agent Skills Directory

[COMMAND_EXECUTION]: The management scripts (claude-profiles.sh, setup.sh, sync-local-skill-sources-daemon.sh) rely on numerous shell commands such as ln, mkdir, launchctl, git, and uv to manage the filesystem, coordinate background services, and monitor source checkouts.
[PERSISTENCE]: The sync-local-skill-sources-daemon.sh script installs a macOS LaunchAgent (ai.daymade.claude-skill-source-sync) that runs automatically at load and on specific file change events (WatchPaths) to maintain profile and skill synchronization in the background.
[EXTERNAL_DOWNLOADS]: The sync-local-skill-sources-daemon.sh script uses the uv tool to download and install a specific Python 3.12 interpreter into the configuration directory (~/.config/claude-switch-models-setup/python/) to ensure the synchronization daemon runs with a consistent runtime environment.
[DYNAMIC_EXECUTION]: sync-local-skill-sources.py utilizes the ctypes library to load system C libraries for platform-specific atomic file operations (renameatx_np on macOS and renameat2 on Linux). Additionally, shell scripts utilize inline Python execution via heredocs and python3 -c for processing structured configuration data.
[CREDENTIALS_UNSAFE]: The profile management system explicitly handles and stores provider API keys (e.g., Kimi, DeepSeek, GLM) in plain text within settings.json files. While this follows the security model of the target application (Claude Code), the skill centralizes and automates the management of these sensitive files.
[INDIRECT_PROMPT_INJECTION]: The sync-profile-settings.py script performs complex merging and overwriting of configuration data from settings.json and .claude.json across all profiles. The ingestion of these configuration files, which could theoretically be influenced by external project data, creates an attack surface for manipulating agent behavior settings. This finding follows the mandatory evidence chain for indirect injection: (1) Ingestion points: settings.json and .claude.json; (2) Capability inventory: Filesystem manipulation and shell command execution across various utility scripts; (3) Sanitization and Boundary markers: No explicit validation or delimiter-based isolation was observed for the merged configuration keys.

claude-switch-models-setup