The Agent Skills Directory

[COMMAND_EXECUTION]: In SKILL.md, the step to filter sessions uses bash ${CLAUDE_PLUGIN_ROOT}/scripts/retrospect-load-sessions.sh $@. Passing the $@ variable directly to a shell script allows all user-provided arguments to be interpreted by the shell, which can lead to command or argument injection if the input is not strictly validated or escaped by the receiving script.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and analyzes historical session data. Ingestion points: Step 3 in SKILL.md reads session files to extract conversation turns, tools used, and git context. Boundary markers: None; the instructions do not specify the use of delimiters or warnings to ignore instructions embedded within the session logs. Capability inventory: The skill has the capability to execute shell commands (Bash) and write files to the disk (Write). Sanitization: There is no evidence of sanitization, filtering, or escaping of the session content before it is processed by the model.

retrospect-domain