The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive local files to audit usage, specifically ~/.claude/history.jsonl (containing full conversation history) and ~/.claude/projects/*/memory/*.md (containing project-specific user notes). While this access is required for the skill's primary function of tallying usage evidence, it exposes private interaction history to the agent context.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted historical data.
Ingestion points: ~/.claude/history.jsonl, ~/.claude/projects/*/memory/*.md, and session transcripts in ~/.claude/projects/*/*.jsonl.
Boundary markers: Absent. The agent is instructed to read these files directly to determine usage and user intent.
Capability inventory: Execution of a local Node.js script (tally.mts), execution of npx skills remove, and manual deletion of directories.
Sanitization: None. The skill reads and interprets raw historical text to find prose traces of desired functionality.
[COMMAND_EXECUTION]: The skill executes a local Node.js utility script provided with the skill and uses the npx skills remove command to modify the system's installed skills based on the audit results.

sangkayana