The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of agent extensions from arbitrary GitHub repositories via the npx skills add <owner>/<repo> command. This allows the introduction of third-party code and instructions into the agent's environment without automated verification of the source's safety.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute multiple shell commands, including npx skills for package management, ln -s for creating symbolic links between skill directories, and python3 to run a local usage analysis script. These commands manage the execution environment of the agent.
[DATA_EXFILTRATION]: The skill accesses highly sensitive data by reading JSONL session transcripts located in ~/.claude/projects/ and ~/.codex/sessions/. While the intended use is for token efficiency analysis, these files contain the full history of user-agent interactions, including potentially sensitive data and tool outputs.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes untrusted content from two sources:
Ingestion points: Third-party SKILL.md files during auditing and .jsonl transcript files during efficiency analysis.
Boundary markers: The instructions lack explicit delimitation or 'ignore instructions' wrappers when reading these files, although auditing is performed by a separate sub-agent.
Capability inventory: The agent has capabilities to install new skills (npx skills), link directories (ln -s), and manage Git repositories.
Sanitization: There is no evidence of sanitization or filtering for the content read from external skills or transcripts before it is processed by the agent or auditor.

maintain-skills