The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/history_index.py is configured to download binary shared libraries from an unverified GitHub repository (wangfenjin/simple) and execute them by loading them as SQLite extensions via connection.load_extension(). Although hardcoded SHA-256 hashes are verified before loading, the binaries themselves are opaque and originate from a source that is not a trusted vendor or organization.
[EXTERNAL_DOWNLOADS]: The skill performs unauthenticated downloads of platform-specific binary archives from GitHub and embedding models from Hugging Face during its setup and indexing phases. While Hugging Face is an established platform, the GitHub source for the text processing extension is not a trusted organization or well-known service.
[DYNAMIC_EXECUTION]: scripts/history_index.py utilizes dynamic loading of compiled libraries at runtime via the SQLite extension mechanism to enable specialized search features.
[COMMAND_EXECUTION]: Multiple scripts execute shell commands through the subprocess module. For example, scripts/read_claude_session.py runs git commands based on project paths, and scripts/_core/text.py invokes rg (ripgrep) or grep on local files. This creates a vulnerability to command injection if input parameters such as project paths are manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process session history logs containing untrusted user content, creating an attack surface:
Ingestion points: scripts/_core/text.py reads and parses JSONL session records containing user-authored text.
Boundary markers: Missing across many search operations; recovery logic relies on file versioning metadata rather than context isolation.
Capability inventory: Includes filesystem writes (recover_content.py), shell command execution (read_claude_session.py), and generation of local reports (extract_user_messages.py).
Sanitization: Content is escaped for HTML output in extract_user_messages.py, but the skill lacks logic to neutralize or sanitize natural language instructions found in conversation history before the agent processes them.

read-claude-code-history