The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to read session transcripts from the ${CLAUDE_CONFIG_DIR:-$HOME/.claude}/projects/ directory to verify the audit log. While intended for internal consistency checks, this allows the agent to access private interaction history stored in a sensitive hidden configuration directory outside the current working directory.
[INDIRECT_PROMPT_INJECTION]: The auditing and cross-model review phases involve the agent and a subagent reading the full conversation transcript. If the transcript contains data fetched from untrusted external sources (e.g., a website or a PR description), those instructions could influence the agent's behavior during the review process.
Ingestion points: Transcript files in ${CLAUDE_CONFIG_DIR:-$HOME/.claude}/projects/<encoded-cwd>/.
Boundary markers: Absent; the agent is instructed to read the raw log content.
Capability inventory: Shell script execution (scripts/log.sh), subagent spawning, and file system access.
Sanitization: The scripts/log.sh utility includes sanitization logic to prevent TSV/CSV formula injection by prefixing suspicious characters with a single quote, but the transcript ingestion process lacks sanitization for embedded instructions.
[COMMAND_EXECUTION]: The skill relies on scripts/log.sh to append entries to the decision log and references an external Node.js script to resolve project directories. Both involve executing local code to support the logging and auditing workflow.

show-me-your-work