The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill identifies and attempts to read host-global configuration files that frequently contain sensitive information, including API keys and provider credentials. Targeted files include:
~/.claude/settings.json (CLI user settings)
~/Library/Application Support/Code/User/settings.json (macOS VSCode settings)
~/.config/Code/User/settings.json (Linux VSCode settings)
%APPDATA%/Code/User/settings.json (Windows VSCode settings)
[DATA_EXFILTRATION]: The diagnostic protocol requires reading files outside the repository's root directory (Phase B). Although the skill specifies a privacy contract and redaction steps, the agent is instructed to read the content of these files into its context, which represents a data exposure risk if redaction is incomplete or if the user is socially engineered into providing access to sensitive paths.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection through the ingestion of untrusted configuration files.
Ingestion points: Phase A automatically reads .vscode/settings.json, .claude/settings.json, and .claude/settings.local.json from the current project directory.
Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" markers for the content being read from these files.
Capability inventory: The skill uses Read, Bash, and Glob tools to process these files.
Sanitization: The skill relies on filtering specific JSON keys, but lacks robust sanitization to prevent malicious instructions embedded within those values from influencing the agent's logic during the "Compute resolved state" or "Diagnosis" steps.

permission-check