The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to access sensitive file paths on the local system that contain user interaction history and configuration data.
Evidence: SKILL.md directs the agent to read from ~/.claude/projects/, ~/.codex/sessions/, and ~/.config/ox/models.md to audit the decision trail.
These paths are highly sensitive as session logs often contain the full history of user prompts and agent responses, potentially including credentials, private logic, or personal information shared during a session.
[INDIRECT_PROMPT_INJECTION]: The skill defines a process that ingests untrusted data from session logs, creating a vulnerability surface for indirect prompt injection.
Ingestion points: Local session history files (e.g., .jsonl files in ~/.claude/projects/).
Boundary markers: The instructions lack specific boundary markers or requirements for the agent to ignore instructions embedded within the transcript data being audited.
Capability inventory: The skill has the capability to write to the filesystem via scripts/log.sh and delegate tasks to subagents.
Sanitization: While the output logger scripts/log.sh sanitizes for spreadsheet formula injection, there is no sanitization or validation performed on the input transcript data before the agent processes it.

show-me-your-work