The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/test_claude_session.py file uses subprocess.run to execute the main script during unit tests. The command arguments are strictly controlled, using absolute paths and validated constants, which prevents any risk of shell injection or unauthorized command execution.
[PROMPT_INJECTION]: The skill is designed to ingest and process untrusted transcript data from the local Claude configuration directory, creating a surface for indirect prompt injection. This is mitigated by several factors:
Ingestion points: Data is read from JSONL files in ~/.claude or specified config directories via scripts/claude-session.py.
Boundary markers: SKILL.md explicitly instructs the agent that transcript content is untrusted data and must not be interpreted as instructions.
Capability inventory: The core script is read-only and does not possess capabilities to write files, execute shell commands, or access the network.
Sanitization: The script implements length truncation for both text and tool inputs and defaults to bounded views to minimize the exposure to malicious payloads.

claude-session