The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Python subprocess module in scripts/serve.py to execute its indexing script (index.py) and system-level file openers (such as open on macOS or explorer on Windows). These calls are used to provide the tool's core functionality. The implementation correctly avoids using the system shell (shell=False) and passes arguments as lists, which effectively mitigates command injection risks.
[DATA_EXPOSURE]: The scripts/index.py script scans sensitive directories, specifically ~/.claude/projects and ~/.codex/sessions, to parse session logs for tool usage statistics. While these are sensitive locations, the access is local, read-only, and explicitly documented as the skill's primary purpose for providing usage telemetry.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from user-specified directories, extracting metadata like titles and frontmatter from files to build the dashboard index. This represents an attack surface where a malicious file could contain prompt injection content. However, the skill instructions (SKILL.md) include guidelines that prevent the agent from reciting file lists directly in the chat, reducing the likelihood that such content would be processed as instructions by the LLM.
[SAFE_PRACTICES]: The skill implements robust path validation in scripts/serve.py via safe_join and _resolve functions. These functions use .resolve() to handle symbolic links and verify that all file access remains within the user-defined root directory or specific whitelisted paths (~/.claude and ~/.codex). Additionally, the HTTP server is strictly bound to 127.0.0.1 to prevent external network access.

view-your-harness