The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes a local Node.js script to retrieve session statistics. The command uses standard environment variables to resolve the script path and session context.
Evidence: SKILL.md executes node "${CLAUDE_PLUGIN_ROOT}/hooks/scrooge-stats.js" --session-id "${CLAUDE_SESSION_ID}".
[INDIRECT_PROMPT_INJECTION]: The skill acts as a reporting tool for session data, which represents a surface for indirect injection if the processed logs contain malicious instructions.
Ingestion points: SKILL.md (via command output from the statistics script).
Boundary markers: The instructions state to report output "verbatim" and avoid fabrication, though no technical delimiters are applied to the displayed stats.
Capability inventory: The skill is restricted to executing its specific internal statistics script via node.
Sanitization: No explicit sanitization of the script output is performed before it is presented in the chat context.

scrooge-stats