The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes past session logs and memory files which constitute external data source ingestion.
Ingestion points: The agent reads content from ~/.claude/projects/, memory/, and workspace/ using jq, rg, and cat.
Boundary markers: There are no defined delimiters to isolate the log content from the agent's analysis instructions in the prompt.
Capability inventory: The skill is granted Bash and Write capabilities, allowing it to execute commands based on interpreted data.
Sanitization: The instructions require the agent to redact API keys and tokens, but do not specify sanitization for executable or instructional patterns within the logs.
[DATA_EXFILTRATION]: The skill accesses directories containing sensitive user session history.
Evidence: Commands target ~/.claude/projects/ and memory/ folders, which store private interaction history and agent state.
Context: This access is part of the skill's primary purpose and is managed by author-provided rules to prevent the exposure of secrets.
[PRIVILEGE_ESCALATION]: The skill documentation includes setup instructions involving elevated permissions.
Evidence: SKILL.md lists sudo apt install jq as a prerequisite.
Context: The instructions explicitly direct the agent to show these commands to the user for manual execution rather than attempting to run them automatically.

session-logs