The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides a Python script in 'reference/RECOVERY.md' for reconstructing session progress files. The agent is instructed to write this code to a local file and execute it to process session transcripts. This involves the runtime generation and execution of code provided within the skill's reference documentation.
[DATA_EXFILTRATION]: The skill's recovery mechanism accesses Claude Code session transcripts located in the sensitive path '~/.claude/projects/'. These transcripts contain a detailed history of user-agent interactions, including previously entered prompts, tool inputs, and environment data.
[INDIRECT_PROMPT_INJECTION]: The skill reads and processes the 'SESSION_PROGRESS.md' file during its resume and verify workflows. Because this file is located in the project root, it could be modified by external actors (e.g., via malicious pull requests), potentially injecting instructions that the agent might follow when context is restored.
Ingestion points: The agent reads 'SESSION_PROGRESS.md' at the project root when starting or resuming work.
Boundary markers: The skill lacks specific boundary markers or instructions to disregard embedded commands within the session file's markdown content.
Capability inventory: The agent has permissions to read/write files, execute git commands, and run shell/Python scripts.
Sanitization: There is no evidence of sanitization or strict schema validation of the markdown content retrieved from the session file.

track-session