The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/agent_sessions/opencode.py to execute the local opencode binary for session indexing and retrieval. While arguments appear to be controlled and shell=False is implied, this allows the agent to trigger system binary execution.
[DATA_EXFILTRATION]: The skill accesses a large number of sensitive local application directories to read private agent session logs, including ~/.claude, ~/.codex, ~/.opencode, ~/.senpi, and VS Code global storage for various extensions. These files contain private conversation history, project structure details, and potentially hardcoded credentials from previous sessions. Although no network exfiltration was detected in the provided code, the skill provides the agent with extensive read access to private data.
[COMMAND_EXECUTION]: The entry-point script scripts/find-agent-sessions.py dynamically loads and executes the CLI module using runpy.run_module, which is a form of dynamic code execution for the tool's core logic.
[PROMPT_INJECTION]: As a retrieval tool, the skill is vulnerable to indirect prompt injection. It parses historical transcripts from numerous local sources (JSONL, SQLite, Markdown) and interpolates them into the agent's context without sanitization. Malicious instructions placed in historical logs by a previous agent session or external actor (e.g., via a reviewed file) could influence the agent's current behavior.

coding-agent-sessions