The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive identity, policy, and memory files (SOUL.md, USER.md, ACCESS_POLICY.md, MEMORY.md). This access is intrinsic to the skill's purpose of auditing the context stack. As these files are defined as "always-loaded," they are already part of the agent's persistent execution environment; therefore, reading them for audit purposes does not introduce significant new data exposure beyond the generated report.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external, user-controllable project files into the agent's context for analysis, creating a potential surface for indirect prompt injection where malicious instructions could influence the agent's audit findings.
Ingestion points: Reads CLAUDE.md, AGENTS.md, SOUL.md, USER.md, ACCESS_POLICY.md, HEARTBEAT.md, and MEMORY.md (via the read and shell tools).
Boundary markers: The procedures rely on natural language descriptions and do not specify strict structural delimiters or explicit instructions for the model to ignore embedded commands within the audited content.
Capability inventory: Employs the shell tool for file checks and calculations, the read tool for accessing file content, and the gbrain tool suite for evaluation and configuration management.
Sanitization: No explicit filtering or sanitization of the audited file contents is mentioned before the agent processes the data or before the report is sent to the evaluation model.
[COMMAND_EXECUTION]: The skill uses the shell tool to perform non-mutating operations, including file existence checks and approximate token count calculations using the wc -c command.

context-audit