The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to read sensitive local data, specifically session transcripts and history from various AI agent tools such as Claude Code, Codex, and Cursor.
It accesses sensitive paths including ~/.claude/projects, ~/.codex/history.jsonl, ~/.cursor/prompt_history.json, and ~/.local/share/opencode/opencode.db.
While no network exfiltration is present in the provided scripts, these logs can contain sensitive user information, including credentials, tokens, or private code shared in previous sessions.
[COMMAND_EXECUTION]: The skill utilize subprocess.run() to execute local tools and helpers.
scripts/collect.py invokes other local Python scripts to aggregate data.
scripts/git_stats.py executes the git command-line tool to mine contribution statistics (e.g., git log, git config).
[PROMPT_INJECTION]: The skill processes historical transcript data and git logs, which serves as a potential surface for indirect prompt injection if an attacker can poison the user's history.
Ingestion points: Local JSONL and SQLite files containing user prompts and git commit messages are processed by scripts/extract_prompts.py and scripts/git_stats.py.
Boundary markers: No explicit delimiters or boundary markers are used to isolate ingested data from the agent's context in the final report.
Capability inventory: The skill possesses file system read/write capabilities and the ability to execute shell commands via git.
Sanitization: Basic text filtering is performed (e.g., an is_prose check that filters out tool results and system markers), but it does not perform robust validation against adversarial instructions embedded in the history.

assess-me