The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon session.jsonl files, which contain the full history of past agent interactions, including user prompts and tool outputs. This historical data is considered untrusted as it may contain malicious instructions received in a prior session that could be 'replayed' or executed during a restoration process.
Ingestion points: The agent reads from session.jsonl and subagent/<id>/session.jsonl to recover context or restore work.
Boundary markers: The skill does not define specific delimiters or instructions for the agent to ignore potentially malicious embedded content within the logs it is reading.
Capability inventory: The skill instructions explicitly direct the agent to perform file system mutations (write_file, edit_file, apply_patch) and shell writes based on the content found in the logs.
Sanitization: The skill explicitly discourages sanitization or paraphrasing in favor of verbatim data extraction ("extract the bytes from the record and write those"), which is necessary for data integrity during restoration but allows for the direct re-injection of past malicious payloads.
[COMMAND_EXECUTION]: The skill utilizes standard system utilities (ls, grep, tail) and first-party CLI tools (muse resume, muse exec, muse export, muse trace) to manage and inspect session data. These operations are restricted to the agent's own data directory (~/.local/share/muse/sessions/), which limits the scope of potential impact.

read-session