The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to read ~/.claude/settings.json across multiple audit steps (Checks 1, 2, 3, and 4). This file is the primary configuration store for the Claude Code environment and frequently contains sensitive data, including authentication tokens, API keys, and session-specific credentials. Accessing this path constitutes sensitive file exposure.
[COMMAND_EXECUTION]: The skill contains a directive to "Run all checks automatically. Do not ask for confirmation. Read the relevant files and produce the full report in one pass." This instruction suppresses the user's ability to review or consent to sensitive local file system access before it occurs.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its processing of untrusted project-level data:
Ingestion points: The skill reads CLAUDE.md files from the project hierarchy, hook files defined in settings, and other skills located in ~/.claude/skills/*.md.
Boundary markers: There are no instructions provided to wrap these external inputs in delimiters or ignore embedded instructions during processing.
Capability inventory: The agent possesses read capabilities for the user's home directory configuration and project files during the audit process.
Sanitization: There is no evidence of sanitization, validation, or escaping of the content found in CLAUDE.md or hook scripts before they are interpolated into the agent's context.

cache-audit