The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install the ecc-agentshield package from the npm registry and references its source code at github.com/affaan-m/agentshield. This source is not verified as a trusted organization or well-known service.
[COMMAND_EXECUTION]: The skill provides instructions to execute various shell commands including npx ecc-agentshield scan and npm install -g ecc-agentshield. These commands execute third-party code with access to the local filesystem and environment.
[DATA_EXFILTRATION]: The skill recommends setting an ANTHROPIC_API_KEY environment variable to enable deep analysis features (--opus). Providing sensitive API keys to third-party tools poses a risk of credential exposure if the tool is compromised or malicious.
[INDIRECT_PROMPT_INJECTION]: The skill describes a system for processing untrusted repository data including CLAUDE.md, settings.json, and agent definitions.
Ingestion points: Processes files within the .claude/ directory, CLAUDE.md, and hooks/ (SKILL.md).
Boundary markers: No boundary markers or sanitization instructions are specified for handling potentially malicious instructions embedded in the scanned files.
Capability inventory: The tool possesses file-read access to sensitive configuration files and file-write capabilities through the --fix flag (SKILL.md).
Sanitization: No explicit sanitization or validation of the input data is mentioned before processing.

security-scan