The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process various repository files including CLAUDE.md, .claude/rules/**/*.md, and docs/agents/. These files are user-controlled or external to the skill and could contain malicious instructions intended to influence the agent's reporting or auditing behavior.
Ingestion points: CLAUDE.md, AGENTS.md, .claude/rules/, .claude/settings.json, and ~/.codex/sessions/ files.
Boundary markers: The skill does not provide explicit boundary markers or instructions to ignore embedded commands within the files it audits.
Capability inventory: The skill utilizes file reading capabilities to inventory documents and proposes edits/deletions based on its findings.
Sanitization: No sanitization or validation of the content within the audited files is described.
[DATA_EXFILTRATION]: The skill instructions direct the agent to access and analyze files located at ~/.codex/sessions/<yyyy>/<mm>/<dd>/rollout-*.jsonl. While this is used to calculate token counts ('reading the meter'), these files represent local session history which may contain sensitive context from previous interactions.
Evidence: Instructions in the 'Read the meter' section explicitly mention reading session rollout JSONL files to extract token_count records.

audit-agent-docs