The Agent Skills Directory

[COMMAND_EXECUTION]: The distill workflow instructs the agent to execute gh issue create with arguments (--title, --body) populated from synthesized archive content. If the content contains shell metacharacters (such as backticks or semicolons) and is not properly escaped by the agent, it could lead to arbitrary command execution on the user's system.
[DATA_EXFILTRATION]: The skill provides tools (mine, recall, search) that aggregate and process sensitive data, including conversation transcripts (.jsonl files) and work session history located in ~/.claude/projects/. While this is central to the skill's purpose, it represents a high-privilege capability that could be abused to access or exfiltrate personal information.
[PROMPT_INJECTION]: The ingest and harvest workflows process untrusted data from external URLs and local files. The 'ripple pass' logic involves the agent reading this data to update other notes in the archive. This creates a surface for indirect prompt injection, where malicious instructions embedded in a source could attempt to influence the agent's behavior during the update or retrieval process.
[EXTERNAL_DOWNLOADS]: The ingest command uses curl and WebFetch to download content from arbitrary URLs provided as arguments to the skill, which is then processed and stored in the local knowledge base.

Cortex