The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Python utility (scripts/session_stats.py) and various shell commands including jq, rg, fd, and find. These tools are used to locate, parse, and aggregate metadata from session transcripts. The operations are confined to the user's local directory and focus on counting and structural analysis.
[DATA_EXFILTRATION]: The skill accesses session transcripts located in ~/.claude/projects, which are sensitive as they contain full histories of agent interactions and tool outputs. This represents a data exposure surface. However, the risk is mitigated by explicit instructions to report only aggregate counts and metadata, and by the script's program_name logic which uses shlex and regular expressions to strip environment variables and credentials from command lines before they are reported to the user.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data in the form of historical session logs, which could contain malicious instructions from previous sessions. This presents an indirect prompt injection surface. The skill mitigates this by primarily performing non-interpretive analysis (counting tokens and command frequencies). Mandatory evidence chain:
Ingestion points: Historical transcript files in ~/.claude/projects/*.jsonl.
Boundary markers: Instructions explicitly warn the agent not to report message text or tool output and to verify candidate matches only by index.
Capability inventory: Full access to shell execution and Python script execution within the agent's environment.
Sanitization: The session_stats.py script sanitizes command strings using shlex.split, and the provided jq recipes include regex filters to ensure only 'safe' characters in program names are extracted.

audit-agent-sessions