The Agent Skills Directory

[DATA_EXFILTRATION]: Accesses sensitive local files containing configuration and session history.
Reads ~/.claude.json to access skill usage metadata and priority scores.
Scans ~/.claude/projects/*.jsonl to process historical session transcripts, which may contain private user data and previously executed commands.
[COMMAND_EXECUTION]: Executes local system and platform-specific CLI tools.
scripts/fitness.py uses subprocess.run to invoke git archive for analyzing skills within specific git references.
scripts/trigger.py uses subprocess.Popen to execute the claude CLI with test prompts to measure skill selection performance.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources (historical transcripts) that could contain malicious instructions.
Ingestion points: Reads session transcripts from ~/.claude/projects/ in scripts/fitness.py.
Boundary markers: None implemented for the transcript scanning logic.
Capability inventory: Includes local command execution (git, claude) and broad file system read access.
Sanitization: Content is analyzed using regex and AST parsing to identify imports and code 'shapes' rather than being directly executed or re-interpolated into new system prompts.
[DYNAMIC_EXECUTION]: Performs runtime analysis and extraction of executable content.
Uses ast.parse and ast.walk in scripts/fitness.py to analyze Python code snippets mined from session transcripts for the 'absorb' feature.
Uses the tarfile module to dynamically extract skill content from git archives at runtime.

skill-fitness