The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes several shell commands (e.g., ls, grep, mktemp) and runs local Python and JavaScript scripts included in the package.
Evidence: SKILL.md contains instructions for the agent to run python3 -I on session_audit.py and execute shell commands to locate transcripts.
Mitigation: The Python script is executed with the -I flag (isolated mode), which ignores environment variables and user site-packages, reducing the risk of environment manipulation.
[INDIRECT_PROMPT_INJECTION]: The skill processes historical session transcripts which could potentially contain malicious instructions embedded by previous tasks or external data source interactions recorded in those sessions.
Evidence: The workflow in workflow.js involves reading user_turns.txt and digest bundles in full to synthesize a report.
Mitigation: The skill implements strict RULES for the analyzing agents, explicitly forbidding network access, git operations, and tool output quoting. Ingestion points include ~/.claude/projects/ and data is processed through multiple sanitization steps (masking and clipping).
[SAFE]: The skill demonstrates high security maturity by implementing several defensive best practices for handling sensitive data.
Evidence: session_audit.py uses os.umask(0o077) to ensure output directories are only readable by the current user. It includes a comprehensive mask() function using regex to redact private keys, API tokens, and credentials. It also features a scan command to verify that no secret patterns remain in the final report before delivery. The skill specifically checks that the output directory is not inside a git repository to prevent accidental credential leakage into version control.

session-audit