The Agent Skills Directory

[DATA_EXPOSURE]: The analyzer scripts (analyzers/claude-code.mjs and analyzers/codex.mjs) access and parse session transcript logs located in ~/.claude/projects/ and ~/.codex/sessions/. These logs contain the full history of user prompts and tool outputs, which may include sensitive information or credentials discussed in previous sessions.
[COMMAND_EXECUTION]: The skill executes local Node.js scripts provided in the package to process transcripts. It also invokes shell commands like cp to manage report templates.
[REMOTE_CODE_EXECUTION]: The skill facilitates the discovery and installation of third-party agent skills using the npx skills command. This mechanism involves downloading and executing code from external repositories.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and summarizes untrusted historical data (past session transcripts). Malicious instructions previously encountered by the agent (e.g., in a file read during a past session) could influence the current agent's narrative summary or installation recommendations.
Ingestion points: Reads transcripts from ~/.claude/projects/ and ~/.codex/sessions/.
Boundary markers: None identified in the analysis scripts or instructions to separate raw historical data from the summarization task.
Capability inventory: Subprocess execution via npx skills add and file writing capabilities.
Sanitization: The HTML template uses basic HTML escaping for display, but the agent's logic for generating recommendations does not appear to have specific filtering for embedded instructions in the source logs.

session-compound