The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes Claude Code session transcripts containing untrusted user content. This data is passed to sub-agents (routing-analyst, portfolio-analyst, improvement-planner) for analysis, creating a surface for indirect prompt injection attacks.\n
Ingestion points: scripts/collect_transcripts.py reads .jsonl session history files from the ~/.claude/projects/ directory.\n
Boundary markers: The coordinator agent provides instructions to sub-agents to read transcript files without utilizing explicit boundary markers or instructions to ignore malicious embedded content.\n
Capability inventory: Analysis sub-agents utilize the general-purpose Agent tool with file system and command execution permissions. The improvement-planner agent generates patch files that are subsequently used to modify SKILL.md files.\n
Sanitization: There is no evidence of sanitization or escaping of transcript content before it is processed by the LLM-based sub-agents.\n- [DATA_EXFILTRATION]: The skill accesses sensitive internal platform directories, specifically ~/.claude/projects/ for session history and ~/.claude/skills/ for skill definitions, to gather data for auditing. No network exfiltration was detected.\n- [COMMAND_EXECUTION]: The workflow involves executing several local Python scripts (collect_transcripts.py, collect_skills.py, generate_report.py, apply_patches.py) to gather data and generate reports. The patch application script performs automated write operations on skill definition files.\n- [DYNAMIC_EXECUTION]: \n
The SKILL.md file contains a Python block in Step 4 used for session batching logic which is executed by the agent at runtime.\n
scripts/collect_skills.py uses the __import__ function to dynamically load the standard datetime module.\n- [EXTERNAL_DOWNLOADS]: The skill recommends installing the tiktoken package via pip for token counting purposes, which is a well-known library.

skill-auditor