The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive project data including conversation logs and the .claude/settings.local.json configuration file. This access is necessary for the skill's primary function of auditing the project environment. It includes instructions to redact credentials and only performs limited checks on API keys (first 5 characters) to verify their presence without exposing full secrets.
[COMMAND_EXECUTION]: The skill executes a local collection script (scripts/collect-data.sh) and uses Python for JSON parsing. These are standard operations for a diagnostic tool and do not involve untrusted external command execution.
[PROMPT_INJECTION]: The skill processes untrusted user data from conversation logs. To mitigate the risk of indirect prompt injection, it includes explicit instructions for its analysis subagents to treat this content as untrusted and to ignore any instructions found within the logs.

health