The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reconstructs context by mining chat transcripts from several agent harnesses including Cursor, Claude Code, Pi, Codex, and OpenCode. This process creates an attack surface where malicious instructions embedded in previous conversation history could be re-activated and executed during the recall process.
Ingestion points: JSONL and JSON transcript files located in ~/.cursor/, ~/.claude/, ~/.pi/, ~/.codex/, and ~/.local/share/opencode/.
Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands when the agent reads the content of these transcripts.
Capability inventory: The agent is instructed to use system tools such as ls, grep, git, and gh, and is authorized to invoke other skills like why and unslop.
Sanitization: While the instructions mention sanitizing private context before generating public output, there are no safeguards or validation steps defined for the ingestion and processing of the untrusted historical data.

recall