The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes untrusted data from session log files.
Ingestion points: Processes ~/.claude/projects/<project>/<session-id>.jsonl and other log files containing arbitrary user input and tool outputs.
Boundary markers: Absent; the skill does not use specific delimiters or instructions to the agent to ignore potentially malicious commands embedded in the logs.
Capability inventory: Includes file system access, shell command execution (git log), and network transmission (OTLP export).
Sanitization: No evidence of filtering or sanitization of log content before parsing.
[DATA_EXFILTRATION]: The skill provides an OTLP exporter (--export otlp) that transmits session data, including user prompts and tool activity, to an external network endpoint defined by the OTLP_ENDPOINT environment variable.
[CREDENTIALS_UNSAFE]: The skill reads ~/.claude/settings.json, a configuration file that potentially contains sensitive session information or authentication tokens.
[COMMAND_EXECUTION]: The skill executes shell commands (git log) using parameters like branch names and timestamps which could be influenced by the data being audited.

observability-report