The Agent Skills Directory

[DATA_EXFILTRATION]: The skill requests read access to sensitive user configuration directories, specifically ~/.claude/ and ~/.codex/, which may contain settings and session history.
[CREDENTIALS_UNSAFE]: The instructions explicitly direct the agent to audit environment variables used for authentication, such as CODEX_API_KEY and CODEX_ACCESS_TOKEN. Accessing these credentials increases the risk of exposure if the agent session is compromised or logs are captured.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it ingests and processes untrusted data from several sources without clear safety boundaries.
Ingestion points: Fetches external markdown documentation from code.claude.com and learn.chatgpt.com using curl. It also reads local project files such as CLAUDE.md, .rules files, and auto-memory logs.
Boundary markers: No delimiters or "ignore embedded instructions" warnings are specified for the ingested content.
Capability inventory: The skill possesses capabilities including network access (curl), local file reading/writing, and shell command execution (strings, python).
Sanitization: There is no evidence of sanitization or validation of the external or local content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill uses shell commands like strings, rg (ripgrep), and which on local files and binaries to discover undocumented configuration keys and verify CLI behavior.
[DYNAMIC_EXECUTION]: The skill executes dynamic Python scripts at runtime to validate the syntax of TOML and JSON configuration files after edits are made.
[EXTERNAL_DOWNLOADS]: The skill fetches documentation from external domains code.claude.com and learn.chatgpt.com. While these are well-known services associated with the platforms being audited, downloading external content for processing is a notable behavior.

audit-agent-settings