The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to install the codeburn utility globally from the public npm registry (npm install -g codeburn) or execute it directly using npx. These resources originate from a third-party repository (github.com/getagentseal/codeburn) that is not identified as a trusted vendor.
[REMOTE_CODE_EXECUTION]: The use of npx codeburn allows for the fetching and execution of code from the npm registry at runtime, which bypasses local inspection if the package is updated on the registry.
[COMMAND_EXECUTION]: The skill's primary functionality is delivered through the execution of various shell commands (e.g., codeburn status, codeburn report, codeburn optimize) which interact with the local file system and potentially the network.
[DATA_EXFILTRATION]: The tool is specifically designed to read session logs located at ~/.claude/projects/. These files contain a comprehensive record of all AI interactions, including code snippets, system prompts, tool outputs, and any sensitive information or environment variables that may have been shared with or retrieved by the AI during a session.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The tool reads and processes .jsonl session files from ~/.claude/projects/ (SKILL.md).
Boundary markers: None identified; the tool parses unstructured or semi-structured log data.
Capability inventory: Execution of shell commands and hosting a local web dashboard (codeburn web) (SKILL.md).
Sanitization: There is no mention of sanitization or filtering of the ingested session data before it is rendered in the dashboard or exported as JSON/CSV.

codeburn