The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains a significant surface for indirect prompt injection in Step 1.5 of the SKILL.md instructions.
Ingestion points: The skill ingests untrusted data from conversation logs located in ~/.claude/projects/ via the scripts/ingest_token_data.py script.
Boundary markers: Instructions for spawning the claude-code-guide subagent do not define boundary markers (like XML tags or delimiters) to separate instructions from the ingested data.
Capability inventory: The skill possesses the capability to spawn subagents (Agent tool) and execute shell commands (Bash tool), which can be manipulated if a subagent is successfully injected.
Sanitization: Instructions explicitly direct the agent to include findings and root causes from the logs "verbatim" into the subagent's prompt, with no mention of sanitization, validation, or escaping of the external content.
[DATA_EXPOSURE]: The skill accesses sensitive user data as part of its core functionality.
The ingest_token_data.py script reads JSONL files from ~/.claude/projects/, which contain private conversation histories.
While this access is required for token analysis, it exposes sensitive information to the agent's context. No evidence of network exfiltration was found; data is processed locally and stored in a local SQLite database and HTML dashboard.

get-token-insights