The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a Stop hook to automatically run verification scripts (check-complete.sh or check-complete.ps1) when the agent session ends. These scripts are executed via shell or PowerShell using paths computed from environment variables.
[DATA_EXFILTRATION]: The script scripts/session-catchup.mjs accesses sensitive application data by reading conversation logs from the user's home directory (~/.claude/projects/). This exposes previous interaction history, tool outputs, and potentially private data to the current agent session.
[PROMPT_INJECTION]: The session recovery mechanism is vulnerable to indirect prompt injection. By reading and displaying content from past sessions, it can re-introduce malicious instructions that were previously present in conversation logs.
Ingestion points: session-catchup.mjs reads JSONL files from the local filesystem.
Boundary markers: The script provides no isolation or boundary markers when presenting recovered text, allowing potentially malicious historical content to be interpreted as active instructions.
Capability inventory: The agent has access to Bash, Write, and Edit tools, creating a significant impact if injection occurs.
Sanitization: The script does not validate or sanitize the message content extracted from the history logs.
[COMMAND_EXECUTION]: The skill instructions direct the user to execute Node.js scripts that take current directory paths as arguments, which are then used to locate and read files in sensitive system locations.

dineway-planning-with-files