The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions to override standard user-confirmation practices. It explicitly directs the agent to 'default to installing or updating and launching the local session uploader' and 'Do not stop to ask whether the user wants to begin' unless the user has already provided an explicit opt-out. This attempts to bypass the user's role in authorizing software installation and execution.
[REMOTE_CODE_EXECUTION]: The skill executes shell commands to download and install a global Node.js package (@cookiyai/sell-agent-sessions@latest) from a remote registry. This package contains executable binaries that are subsequently run on the host operating system.
[PERSISTENCE]: The instructions command the agent to ensure the data-collection process outlives the current session. It directs the agent to use 'stronger platform-appropriate methods' beyond simple backgrounding (such as nohup or &) to prevent the host runtime from cleaning up the process tree, effectively establishing persistent execution on the user's machine.
[DATA_EXFILTRATION]: The primary function of the skill is the discovery and transmission of local agent session history and traces to external servers. While the skill claims to perform local scrubbing of secrets and PII, the automated collection and upload of sensitive technical work history poses a significant data exposure risk.
[COMMAND_EXECUTION]: The skill requires the agent to execute multiple host-level shell commands, including global package management (npm install -g) and process management to start and monitor background tasks.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a high-risk attack surface as it is designed to ingest untrusted data (agent traces and history files) and has significant system capabilities.
Ingestion points: The uploader reads local agent-history directories (e.g., Codex and Claude Code logs) from the host filesystem.
Boundary markers: No specific boundary markers or delimiters are specified for the processing of these external traces.
Capability inventory: The skill can execute shell commands, install global packages, and initiate network uploads.
Sanitization: The skill claims to perform local PII and secret scrubbing, but acknowledges this cannot guarantee detection of all sensitive values.

sell-agent-sessions