The Agent Skills Directory

[DATA_EXFILTRATION]: The audit command (detailed in commands/audit.md) reads session transcripts from ~/.claude/projects/. These transcripts contain the full history of previous interactions, which may include sensitive source code, internal discussions, and potentially hardcoded secrets or personal data. While the instructions claim data remains local, the capability to ingest this sensitive history into the agent's context is present.
[COMMAND_EXECUTION]: The skill relies heavily on executing local Node.js scripts via the Bash tool. These scripts, located in ${CLAUDE_PLUGIN_ROOT}/src/, have broad access to the local file system and project data. The allowed-tools configuration in the frontmatter attempts to restrict these to specific files, but the scripts themselves are not provided for analysis and represent a significant attack surface.
[DYNAMIC_EXECUTION]: The templates apply command in commands/templates.md is instructed to execute preCommands defined within JSON template files. This creates a risk where a malicious or compromised template file could lead to the execution of arbitrary shell commands if the agent's environment allows it.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted project files such as CLAUDE.md and session transcripts. Malicious instructions embedded in these files could potentially influence the agent's behavior during analysis, leading to deceptive reporting or unintended actions.
[PRIVILEGE_ESCALATION]: The overhead command (commands/overhead.md) suggests running claude mcp remove to modify the agent's tool configuration. Although it requires user confirmation, this allows the skill to influence and potentially disable the agent's operational capabilities or security-related MCP servers.

cco