The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/audit_repo.py uses subprocess.run with list-based arguments (no shell) to execute local git commands (git ls-files, git log). This is used for repository scale metrics and freshness analysis and is implemented following security best practices.
[DATA_EXPOSURE]: The skill accesses Claude Code configuration files (settings.json, mcp.json) in both project and user home directories (~/.claude/). This is the primary purpose of the skill (auditing settings for security and readiness) and findings are presented to the user in a local report.
[PROMPT_INJECTION]: The skill includes strong safety instructions, requiring the agent to present findings and await explicit user approval before making any file modifications.
[INDIRECT_PROMPT_INJECTION]: The skill audits repository content (e.g., CLAUDE.md) which could theoretically contain instructions intended to influence the agent. However, the skill treats this content as data for a structured report and includes mitigations such as incremental editing and diff reviews.

optimizing-claude-code