The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill accesses sensitive configuration paths including ~/.config/claude/claude_desktop_config.json and %APPDATA%\Claude\claude_desktop_config.json. These files contain authentication tokens and server configurations.
[CREDENTIALS_UNSAFE]: The skill attempts to read system keychain data using security find-generic-password on macOS and secret-tool lookup on Linux to audit OAuth tokens stored for Claude Code.
[COMMAND_EXECUTION]: The skill performs shell command execution using claude mcp status, claude mcp test, and claude mcp login/logout.
[COMMAND_EXECUTION]: There is a risk of command injection as user-provided $ARGUMENTS are interpolated directly into shell commands (e.g., claude mcp test <server-name>) without visible sanitization logic.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting and parsing .mcp.json files from the current working directory.
Ingestion points: .mcp.json (Phase 1, step 3)
Boundary markers: None identified in the instructions.
Capability inventory: File read/write to global config, shell command execution via claude CLI tools.
Sanitization: None identified; the skill directly parses and cross-references local files with global state.

mcp-connection-audit