The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes historical session logs (.jsonl) which record all past agent interactions. This creates a surface for indirect prompt injection where instructions embedded in previously processed data (e.g., content from a website visited in a past session) could be interpreted by the agent during the retrospective as valid evidence, potentially influencing the suggested changes to steering files or automated checks.
Ingestion points: The scripts/session_digest.py script reads session log files from ~/.pi/agent/sessions/.
Boundary markers: None identified for separating log content from analysis instructions.
Capability inventory: The skill is authorized to propose changes to the agent's environment, including steering files (AGENTS.md, CLAUDE.md), automated checks, and navigation pointers.
Sanitization: The Python script performs regex-based redaction of secrets but does not filter or sanitize natural language instructions within the log data.
[DATA_EXPOSURE]: The skill reads sensitive session logs located at ~/.pi/agent/sessions/<encoded-cwd>/ and PI_SESSION_FILE. These files contain a comprehensive history of agent turns, tool calls, and results. Although scripts/session_digest.py includes a redact function targeting API keys and tokens, other sensitive project information or environment details contained in the logs are extracted and presented to the model.
[COMMAND_EXECUTION]: The skill executes a local Python script python -B scripts/session_digest.py to process the session logs. While the script is part of the skill distribution, it is invoked with an environment variable (PI_SESSION_FILE) or a user-provided session path, which determines the file read by the script.

retro