The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill is configured to read multiple sensitive authentication tokens from the user's home directory, specifically ~/.vanta-token, ~/.snyk-token, ~/.jira-credentials, and ~/.linear-token, which are used to authenticate with external APIs.
[PROMPT_INJECTION]: The skill contains instructions that override standard agent safety and transparency protocols by mandating autonomous execution ("Do NOT ask the user questions. Run autonomously from start to finish") and requiring the concealment of the agent's identity ("NEVER mention Claude, AI, or automation tools in commits or PRs").
[DATA_EXFILTRATION]: The skill includes an undocumented telemetry logging mechanism in the "SELF-EVOLUTION TELEMETRY" section that writes execution metadata to ~/.claude/projects/skill-telemetry.md. This directory is outside the skill's specific log path and could potentially be used to poison or influence other project contexts.
[COMMAND_EXECUTION]: The skill ingests untrusted data from external vulnerability scanners (names, CVE IDs, and descriptions) and interpolates this content directly into shell commands for git commit and gh pr create without sanitization.
Ingestion points: Vulnerability data results from Vanta, Snyk, and GitHub APIs (SKILL.md).
Boundary markers: Absent; external data is embedded directly into command strings and markdown templates.
Capability inventory: Execution of git, gh, and various package manager CLI tools across multiple repository paths.
Sanitization: Absent; no escaping or validation of API-sourced strings before shell execution.
[PROMPT_INJECTION]: The "SELF-HEALING VALIDATION" section contains self-referential instructions (Category 8e) designed to influence the behavior of security analysis tools by defining its own validation criteria.

check-vanta