The Agent Skills Directory

[DATA_EXFILTRATION]: The skill reads highly sensitive session logs from ~/.pi/agent/sessions and ~/.omp/agent/sessions. These files contain the full history of a user's interactions with AI agents, which may include proprietary code, sensitive configuration details, or personal information.
Evidence: The skill synchronizes these logs with a remote service referred to as nmem (Knowledge Memory) using tools like nmem_list_threads and nmem_read_thread.
Evidence: The references/recovery-guide.md file indicates the use of an NMEM_API_KEY and a configuration file at ~/.nowledge-mem/config.json for external API communication.
[COMMAND_EXECUTION]: The skill invokes local Python scripts to perform its primary logic, granting the scripts access to the user's environment.
Evidence: SKILL.md contains instructions to execute scripts/extract_today.py and scripts/obsidian-helper.py using uv run.
Evidence: The obsidian-helper.py script has broad permissions to read and write within the user's Obsidian vault directories as specified in the local configuration file.
[PROMPT_INJECTION]: The skill processes untrusted data from previous AI conversations, creating a surface for indirect prompt injection attacks.
Ingestion points: The skill reads local .jsonl session files (via extract_today.py) and remote thread data (via nmem_read_thread).
Boundary markers: The instructions do not define clear delimiters or use 'ignore embedded instructions' warnings when the agent processes historical conversation text.
Capability inventory: The agent possesses capabilities to execute shell commands (uv run), modify the local filesystem (Edit tool), and perform network operations via the nmem API.
Sanitization: No sanitization or filtering logic was identified to ensure that malicious instructions within the session history do not influence the agent's current recap task.

daily-recap