The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive conversation history stored in Claude Code transcripts located at ~/.claude/projects/. This data exposure is a core feature intended to audit agent time and performance. To mitigate risk, the skill implements a redact function in scripts/common.js that uses regular expressions to mask common API keys and tokens (e.g., GitHub PATs, AWS keys, Slack tokens) before they are stored in the audit report or trend CSV.
[COMMAND_EXECUTION]: The audit scripts execute local commands using execFileSync to interact with git and the GitHub CLI (gh). These commands are used to fetch repository metadata, commit history, and workflow run details. The execution is limited to these specific binaries and uses arguments derived from the repository's configuration.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, creating a potential attack surface.
Ingestion points: GitHub Actions run logs (gh run view --log-failed), Git commit messages (git log), and conversation transcript files (~/.claude/projects/*.jsonl).
Boundary markers: The skill provides instructions to sub-agents in templates/loop-brief.md that explicitly constrain behavior: "Read-only: do not edit, commit, push, re-run or cancel anything. Do not start builds, servers or simulators."
Capability inventory: The skill uses the Bash tool for repository analysis and the agent's file-writing capabilities to generate code fixes.
Sanitization: A redact function is used to sanitize secrets found in ingested data, although it does not specifically filter for prompt injection patterns.
[DYNAMIC_EXECUTION]: Based on audit results, the skill can generate code fixes for CI pipelines and git hooks. These fixes are proposed to the user and, upon approval, are written to a new branch and used to open a pull request. This involves dynamic code generation based on the analysis of repository configuration and logs.

dev-loop-audit