The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local shell commands to facilitate project detection and session management.
Evidence: Uses ls -t ~/.claude/sessions/*-session.tmp to list and sort previous session files.
Evidence: Reads the first 10 lines of session files to extract metadata like project names and topics.
Evidence: Executes standard development tools such as npm, pnpm, git, and node through generated permission settings in .claude/settings.json.
[DATA_EXFILTRATION]: The skill accesses potentially sensitive local files for configuration and session resumption. While no network exfiltration was found, the access scope includes sensitive directories.
Evidence: Scans ~/.claude/sessions/ for temporary session data.
Evidence: Detects environment variable names from .env, .env.example, and .env.local to populate the CLAUDE.md file.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates content from untrusted local files into the agent's context.
Ingestion points: Reads package.json, README.md, git remote URLs, and session files during the auto-detection phase in SKILL.md.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the ingested files are present.
Capability inventory: The skill has the capability to write files (CLAUDE.md, tasks/todo.md, .claude/settings.json) and execute shell commands (git, npm, etc.).
Sanitization: No sanitization or validation of the content read from local project files is performed before interpolation into the generated documentation.

init-decision-tree