The Agent Skills Directory

[COMMAND_EXECUTION]: The script executes local git commands to identify its own version hash when recording measurement baselines.
Evidence: scripts/audit.py uses subprocess.run to call git ls-files, git rev-parse, and git status on the skill's own directory.
[DATA_EXFILTRATION]: The skill accesses sensitive local files containing session history and agent configuration settings, representing data exposure.
Evidence: scripts/audit.py reads Claude Code transcript logs from ~/.claude/projects/*.jsonl.
Evidence: scripts/prompts.py reads configuration from ~/.claude/settings.json to simulate permission engine behavior.
[INDIRECT_PROMPT_INJECTION]: The skill processes and displays content from previous session transcripts, which may contain untrusted data or past malicious instructions that could influence the agent's context.
Ingestion points: ~/.claude/projects/*.jsonl (parsed in scripts/audit.py).
Boundary markers: Absent; transcript content is printed directly into the agent's output buffer.
Capability inventory: Local file writing (baselines and JSON dumps), metadata-focused subprocess calls, and printing to stdout.
Sanitization: Absent; the tool extracts and displays raw command strings and transcript snippets verbatim.

session-bash-audit