The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to execute npm install -g claude-code-lens if the current version is outdated or missing features. This results in the download and global installation of a third-party package from the NPM registry.
[COMMAND_EXECUTION]: The workflow relies on the execution of multiple shell commands to interact with the system and the trace utility, including cclens trace list, cclens trace show, and cclens trace export. It also includes diagnostic commands like cclens trace --help 2>&1.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest, read, and analyze trace logs from Claude Code sessions. Because these logs represent external, potentially attacker-influenced data, they pose a risk of indirect prompt injection.
Ingestion points: The agent uses a Read tool to ingest Markdown files exported to paths such as /tmp/cclens-<session>-<agent>.md or ~/.claude-code-lens/exports/ (SKILL.md, Step 4).
Boundary markers: None identified. The instructions do not specify the use of delimiters or warnings to ignore instructions embedded within the trace data.
Capability inventory: The agent has the capability to execute shell commands (cclens), install global packages (npm), and read/write files in the local filesystem.
Sanitization: No sanitization or validation steps are defined for the content of the trace files before they are processed by the agent.

cclens-trace-analyzer