The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and display historical conversation data from multiple local providers (Claude, Codex, Kimi). This creates an indirect prompt injection surface where malicious instructions stored in past logs could be re-interpreted by the agent during a history audit.
Ingestion points: scripts/analyze_sessions.py, scripts/read_codex_session.py, and scripts/list_codex_user_inputs.py read content from local JSONL, SQLite, and metadata files.
Boundary markers: The skill formats results into Markdown briefings for the agent. While it uses headers and labels to organize the data, there are no specific markers instructing the model to ignore embedded instructions in the historical text.
Capability inventory: The skill executes local Python scripts that have the ability to run shell commands (via subprocess for git, rg, and grep), read various home directory paths, and write to temporary files.
Sanitization: The skill performs Markdown escaping (pipe characters) and whitespace normalization. It also truncates long inputs to fit within model context windows.
[COMMAND_EXECUTION]: Several scripts utilize system commands to gather metadata or optimize searches.
scripts/_core/text.py uses subprocess.Popen to invoke ripgrep (rg) or grep for high-speed file filtering. This implementation follows security best practices by using the -e flag for keywords and -- to terminate arguments before paths, preventing flag injection.
scripts/read_codex_session.py executes git commands (branch, status, log) to report the current workspace state. These calls use hardcoded argument lists, mitigating injection risks.

read-codex-history