The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive file paths including ~/.claude/channels/<channel>/.env and access.json. The instructions explicitly mention that .env contains bot tokens. Although the data is used for local backup and display to the user rather than being sent to a remote server, reading credentials into the agent's context is a sensitive operation.
[COMMAND_EXECUTION]: The skill executes multiple bash commands to manage the file system, including ls, mkdir, cp, and rm. The allowed-tools configuration in the frontmatter restricts these operations to the ~/.claude/channels/ directory, which mitigates the risk of arbitrary system modification.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by reading and processing the contents of local configuration files.
Ingestion points: The skill reads ~/.claude/channels/<channel>/.env and access.json to summarize their contents for the user (Step 2).
Boundary markers: No delimiters or safety instructions are used when displaying the file contents to the agent.
Capability inventory: The skill has the ability to delete directories (rm -rf) and copy files (cp) via the Bash tool.
Sanitization: There is no evidence of validation or sanitization for the data read from the configuration files.

reset