The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to read and expose sensitive configuration data and credentials into the agent's context for auditing purposes. While this constitutes data exposure, no evidence of network exfiltration was found.
Sensitive Access: The skill explicitly reads the user's global MCP configuration (~/.claude.json) and project-specific MCP config (.mcp.json), which may contain sensitive connection details or environment variables.
Credential Discovery: It performs automated searches for high-value secrets across the .claude/ directory, including patterns for Anthropic API keys (sk-), GitHub personal access tokens (ghp_), AWS access keys (AKIA), and private RSA/SSH keys (BEGIN PRIVATE KEY).
Contextual Mitigation: The access to these sensitive paths is fundamental to the skill's stated purpose as a security scanner, which justifies the access for local reporting to the user.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it ingests and processes untrusted content from the local file system into the agent's analysis context.
Ingestion points: The skill reads and greps through various user-controlled files, including MEMORY.md, CLAUDE.md, SOUL.md, and all files within the .claude/skills/ and .claude/hooks/ directories.
Boundary markers: The instructions lack explicit delimiters or system-level warnings to the agent to ignore any natural language instructions that might be embedded within the data it is auditing.
Capability inventory: The skill leverages common shell utilities (cat, grep, find, ls) to pull external file content directly into the active prompt context for the "Security Analyst" persona to evaluate.
Sanitization: No sanitization, escaping, or filtering is applied to the ingested file content before it is presented to the agent, potentially allowing malicious files to influence the auditor's final report.

security-check