The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill reads settings.json and settings.local.json during the inventory phase. These files are standard locations for storing sensitive data such as API keys, tokens, and local environment secrets.
[DATA_EXFILTRATION]: The skill accesses highly sensitive session transcripts across all projects located at ~/.claude/projects/*.jsonl. These transcripts contain full history of interactions, including code snippets and user data. The skill instructions specify using a cheap model (e.g., model: haiku) for mining this data, which involves processing the contents of these sensitive files through an LLM service.
[COMMAND_EXECUTION]: The skill proposes the creation of scripts and hooks as part of its 'escalation ladder.' It also includes instructions to 'inject the exact violation' to test whether new scripts or hooks correctly block unwanted actions, which involves executing potentially unsafe commands to verify the harness changes.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from previous session transcripts to derive new agent rules and configurations.
Ingestion points: Reads all session logs from ~/.claude/projects/<project-dir>/*.jsonl.
Boundary markers: None provided; the skill relies on a model to distinguish between instructional data and historical context within the transcripts.
Capability inventory: The skill has the capability to modify CLAUDE.md, update project settings, and create new executable scripts or hooks.
Sanitization: There is no automated sanitization of the transcript content; the skill relies entirely on manual user review and approval of the resulting diffs before any changes are applied.

tune