The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to read from sensitive local directories including user conversation archives (conversations/) and project transcripts (e.g., ~/.claude/projects/). This access is explicitly declared in the frontmatter and is essential for the skill's primary function of mining usage history to build benchmarks.
[COMMAND_EXECUTION]: The skill invokes platform-specific CLI tools to perform history searches, query data, and execute multi-model evaluations. These appear to be legitimate platform-local utilities for skill management.
Evidence: Use of gbrain search, gbrain query, gbrain transcripts, gbrain skillopt, and gbrain eval cross-modal commands.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from user conversation history, which could contain instructions intended to manipulate the generated evaluation criteria.
Ingestion points: Ingests data from the conversations/ directory and various transcript files.
Boundary markers: The skill enforces separation of sources using HISTORY-IMPLIED and SPEC-DERIVED labels to clearly identify when evidence is derived from potentially untrusted user history.
Capability inventory: The skill can write files to the skills/<name>/eval/ directory and execute subprocesses via the gbrain tool suite.
Sanitization: The instructions mandate a privacy scrub to replace all real names and entities with placeholder slugs (alice-example, acme-example) before staging output, and requires a human gate before final merging.

skill-autobench