The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local shell script (inspect.sh) that uses system bash and python3 to gather metadata about the Claude Code environment. This is the intended behavior for generating the dashboard.
[DATA_EXPOSURE]: The script accesses Claude Code configuration files (settings.json), session logs (.jsonl), and memory files (.md). It extracts project paths, tool settings, and file metadata to display in the dashboard. While this involves sensitive environment information, the data remains on the local machine and is not exfiltrated.
[DYNAMIC_EXECUTION]: The skill generates a self-contained HTML file in the /tmp directory which includes JavaScript for interactive filtering and searching. This file is opened in the default browser using the system open command.
[INDIRECT_PROMPT_INJECTION]: The script processes local file names and skill descriptions to populate the dashboard. Some of these inputs are injected into the HTML without complete escaping, which represents a minor potential surface for local Cross-Site Scripting (XSS) if malicious content already exists in the local environment. This is a low-risk concern for a diagnostic tool.

inspect