The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill manages active session credentials by symlinking the user's authentication file (e.g., ~/.claude/.credentials.json) into temporary directories to facilitate isolated harness testing and automated login refreshes.\n- [DATA_EXFILTRATION]: The skill accesses sensitive session transcripts and logs from multiple AI harnesses (Claude, Cursor, Codex, Pi, OMP) in the user's home directory to generate analytics. It also performs intentional network connection attempts to non-whitelisted domains (1.1.1.1 and example.com) during an isolation preflight routine to verify sandbox constraints.\n- [DYNAMIC_EXECUTION]: The skill implements a code-generation and bundling feature (@new-cli) that allows the agent to write new Python source code, compile it into .pyz archives using the shiv library, and execute the resulting programs.\n- [COMMAND_EXECUTION]: The skill extensively uses system commands to run its bundled utilities (e.g., agent-session-analytics.pyz, skillz-experiment.pyz) and to interact with external AI harnesses through their respective CLIs.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from session logs and other skill definitions while maintaining file-write and execution capabilities. It attempts to mitigate this with instructions to ignore embedded commands in logs, but the attack surface remains significant.\n
Ingestion points: Reads SKILL.md files and session log JSONL files from various harness-specific directories.\n
Boundary markers: Instructions in references/raw-log-fallback.md tell the agent to ignore instructions embedded in log data.\n
Capability inventory: Includes file writing, shell command execution, and dynamic code generation and execution.\n
Sanitization: No specific sanitization or escaping of external text is documented before it is interpolated into model prompts.

skillz