The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/compute_usage.js is vulnerable to shell command injection. It uses child_process.execSync to run a find command, interpolating the --projects argument directly into a shell string without any sanitization or escaping. If the AI agent is prompted to use a malicious path, or if a user-supplied directory name contains shell metacharacters, arbitrary code could be executed on the host system.
Evidence: execSync(find "${args.projects}" -name "*.jsonl" -type f 2>/dev/null) in scripts/compute_usage.js.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill requires access to ~/.claude/projects/, which stores full transcripts of user interactions with Claude Code.
Risk: These transcript logs frequently contain sensitive data, including proprietary code, API keys, and private conversations. While the script currently focuses on token counting, the ability to read these files creates a significant privacy and data exposure risk.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local filesystem (transcript directory names) and provides an attack surface through a lack of sanitization.
Ingestion points: The --projects directory path and the resulting file paths from the find command.
Boundary markers: Absent. There are no delimiters or safety instructions used to isolate these paths from the shell context.
Capability inventory: Shell command execution via execSync and file system reading via fs.createReadStream.
Sanitization: Absent. The input path from args.projects is interpolated directly into a shell command template without validation.

claude-usage