The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted session transcript data which could contain malicious instructions designed to influence the agent's audit process.
Ingestion points: Transcripts located in ~/.claude/projects/ are read by the scripts/sharpen_saw.py script to identify friction points and error clusters.
Boundary markers: The skill does not provide clear delimiters or warnings in its output to separate data extracted from transcripts from the agent's operating instructions, which may lead to the agent following instructions embedded in logs.
Capability inventory: The skill enables the agent to modify critical configuration files such as ~/.claude/CLAUDE.md, ~/.claude/settings.json, and local executables in ~/.local/bin based on the audit findings.
Sanitization: The script aggregates error statistics and masks certain patterns (like digits and paths) for clustering but does not include sanitization or filtering logic to detect or block embedded prompt instructions within the transcripts.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses sensitive interaction history to perform its audit function.
Evidence: The skill is designed to read the agent's complete session history from ~/.claude/projects/, which contains user prompts and tool outputs that may include private data, secrets, or internal project details. While this is the intended functionality of a transcript auditor, it creates a surface for sensitive data exposure.

sharpen-saw