The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references several external packages for policy evaluation and receipt verification, including protect-mcp (NPM and PyPI) and @veritasacta/verify (NPM). It also points to repositories from established organizations like Microsoft and the Cedar Policy project.
[COMMAND_EXECUTION]: The skill instructs users to configure Claude Code hooks (PreToolUse and PostToolUse) that execute shell commands via npx. These commands are used to intercept tool calls for security evaluation and signature generation.
[DATA_EXFILTRATION]: The skill involves the management of an Ed25519 private key (./protect-mcp.key). The instructions include security best practices, specifically advising the user to add the private key and receipt directory to .gitignore to prevent accidental exposure to version control systems.
[INDIRECT_PROMPT_INJECTION]: The skill identifies a surface where tool names and inputs ($TOOL_NAME, $TOOL_INPUT) are passed into external evaluation scripts. It mitigates this risk by providing a structured Cedar policy framework to validate and restrict these inputs before execution.
Ingestion points: Tool metadata and inputs are passed into hooks via environment variables in the Claude Code configuration (.claude/settings.json).
Boundary markers: The instructions recommend using double quotes around variables (e.g., "$TOOL_INPUT") to ensure arguments are handled as single strings by the shell.
Capability inventory: The evaluation process triggers npx commands which have the ability to deny tool execution based on policy.
Sanitization: The skill provides a protect.cedar policy file that implements allow-lists for specific command patterns and explicitly forbids destructive actions.

signed-audit-trails-recipe