The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes historical session messages which may contain untrusted data or previous adversarial instructions.
Ingestion points: Session data is fetched via mcp__ccrider__get_session_messages and stored in temporary JSON files (SKILL.md).
Boundary markers: The subagent prompt lacks explicit delimiters or instructions to ignore embedded commands within the fetched session messages.
Capability inventory: Subagents are granted Bash and Write capabilities to execute analysis scripts and manage results.
Sanitization: The primary analysis logic is performed by a Python script (compute-metrics.py) using regular expressions, which reduces the risk of the LLM directly executing embedded instructions, though the subagent still views the raw message content.
[COMMAND_EXECUTION]: The skill spawns subagents that execute shell commands to run a Python-based scoring script.
Evidence: The subagent prompt includes a Bash command: python3 {SCORER_PATH} {PROJECT_ROOT}/.claude/session-metrics/_tmp_{SHORT_ID}.json ....
[PRIVILEGE_ESTALATION]: Subagents are initialized with a high-privilege mode to bypass standard user confirmations for file and command operations.
Evidence: Every Task invocation uses mode="bypassPermissions" to allow subagents to write files and execute Bash commands without interruption.

session-scan