The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive local application data and configuration files, including ~/.claude/settings.json, ~/.claude/history.jsonl, and the Claude Desktop application support directory (~/Library/Application Support/Claude/local-agent-mode-sessions/). It also reads .env files during configuration resolution. These locations contain high-value data such as full conversation histories, tool call records, and environment-specific variables.
[COMMAND_EXECUTION]: The skill executes external Python scripts (manifest.py, extract-jsonl.py) from a directory path defined by the $OBSIDIAN_WIKI_REPO environment variable. It also invokes several local command-line utilities, including qmd and obsidian-wiki, to update search indexes and sync memory.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Claude conversation histories and audit logs, which could contain malicious instructions from past sessions.
Ingestion points: Conversation logs (.jsonl), memory files (.md), and audit logs (audit.jsonl).
Boundary markers: No explicit delimiter-based prompt boundaries are defined for the ingested text.
Capability inventory: The skill possesses the ability to execute shell commands (python3, qmd, obsidian-wiki), write files to an Obsidian vault, and read diverse local system paths.
Sanitization: The instructions recommend manually skipping secrets and personal content, but there is no mention of programmatic sanitization, escaping, or filtering of the ingested content.

claude-history-ingest