The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The documentation provides instructions to access sensitive files containing authentication tokens.
Evidence: Explains using cat .env to verify CLAUDE_CODE_OAUTH_TOKEN and ANTHROPIC_API_KEY in SKILL.md.
Evidence: Accesses ~/.claude/projects/ which contains session history and potentially sensitive metadata.
[COMMAND_EXECUTION]: The skill provides numerous examples of powerful shell commands that an agent is encouraged to use for troubleshooting.
Evidence: Usage of docker run with arbitrary shell commands via the -c flag to inspect environment variables and file systems in SKILL.md.
Evidence: Instructions to use rm -rf data/sessions/ to clear session data.
Evidence: Usage of sqlite3 to directly modify the application's database.
Evidence: Mentions sudo systemctl start docker in a diagnostic script snippet.
[DATA_EXFILTRATION]: The skill facilitates the reading of sensitive configuration and session data from the host system.
Evidence: Commands like cat /workspace/env-dir/env inside a container mount host secrets for verification.
[PROMPT_INJECTION]: The documented architecture reveals a surface for indirect prompt injection (Category 8).
Ingestion points: SKILL.md documents an entry point where a JSON payload containing a prompt field is piped into a Docker container.
Boundary markers: Absent.
Capability inventory: SKILL.md explicitly lists Bash, Read, and Write as allowed tools for the agent.
Sanitization: Absent.

debug