The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests past session transcripts and metrics, which could potentially contain malicious instructions from previous untrusted user inputs or processed data. However, the skill is strictly limited to proposing fixes and explicitly forbids editing anything without direct user selection, which serves as a robust defense against automated execution of injected instructions.
Ingestion points: The skill reads session records via orchestra sessions report (SKILL.md).
Boundary markers: The instructions lack explicit delimiters or "ignore instructions" warnings for the transcripts, though they impose technical constraints on the volume of data read.
Capability inventory: The skill uses orchestra and canon CLI tools for reporting and state management; it does not have autonomous write access to the project code within this skill's logic.
Sanitization: No specific sanitization of the transcripts is mentioned.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses session history and transcripts that might contain sensitive code or personal information. This access is necessary for its stated purpose of performance analysis. The skill includes specific privacy guardrails, such as limiting transcript reading to 200-line slices and prohibiting the quoting of transcript text or record bodies. There is no evidence of network activity or data being sent to external domains.
[COMMAND_EXECUTION]: The skill executes local CLI tools (orchestra and canon) and standard shell commands (mktemp) to generate reports and manage temporary files. These are used for legitimate diagnostic purposes within the local environment.

analyze-sessions