The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive data by reading Claude Code session logs stored in ~/.claude/projects/. These logs contain full conversation histories which may include code snippets and internal details. While necessary for the 'recall' function, this access exposes sensitive user data to the agent context.
[COMMAND_EXECUTION]: The script scripts/session-graph.py uses subprocess.run to execute the system open command to launch a browser for viewing the generated session graph HTML file.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from historical session logs, creating an attack surface where old messages could influence the agent's current behavior.
Ingestion points: Reads all JSONL files in the ~/.claude/projects/ directory via scripts/recall-day.py and scripts/extract-sessions.py.
Boundary markers: The scripts use a clean_content function with regex patterns to strip system tags like <system-reminder> and <task-notification>, but do not employ robust prompt delimiters to isolate recalled content.
Capability inventory: The skill has access to the Bash tool and file system, and executes local Python scripts.
Sanitization: Content is filtered using regex to remove known system-injected tags before being presented to the agent.
[DYNAMIC_EXECUTION]: The file scripts/session-graph.py performs dynamic module loading by using importlib.util to import recall-day.py at runtime from a computed file path.

recall