The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/serve.sh executes a local HTTP server using python3 -m http.server. By default, it sets the server root to /, which allows any local user or process to access and read the entire filesystem of the host machine via http://127.0.0.1:8775.
[DATA_EXFILTRATION]: The skill performs extensive scanning of sensitive user data directories, specifically ~/.claude/projects and ~/.codex/sessions, to inventory and 'bake' transcript files. This access is core to the skill's auditing purpose but involves the handling of potentially private session history.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from previous agent sessions. Malicious content within these sessions (such as the first user message used as a 'topic') is rendered in the dashboard and included in generated /capture prompts, potentially influencing the behavior of the auditing agent.
Ingestion points: Reads .jsonl session logs from ~/.claude/projects and ~/.codex/sessions (in scripts/inventory.py).
Boundary markers: No explicit delimiters or instructions are used to separate untrusted session content from agent instructions in the generated prompts.
Capability inventory: The skill uses the Bash tool to run scripts like scripts/bake.sh and scripts/serve.sh, and cass for transcript rendering.
Sanitization: Includes basic HTML entity escaping in viewer/dashboard.html but does not thoroughly sanitize the session content processed by the scripts.
[EXTERNAL_DOWNLOADS]: The viewer/dashboard.html file utilizes the fetch API to load coverage data. It can be configured to fetch JSON content from arbitrary external URLs via the coverage query parameter, which could be used to load malicious or deceptive audit data.

cass-coverage