The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes session transcripts (.jsonl files) which contain untrusted data from previous interactions, including tool outputs and user-supplied content. This creates a surface for indirect prompt injection if those transcripts contain malicious instructions designed to influence the reviewer subagents.
Ingestion points: Reads session transcript files from the ~/.claude/projects/ directory (SKILL.md, Step 2 and 3).
Boundary markers: Absent. The subagent prompts in Step 4 and 5 do not include delimiters or specific instructions to ignore embedded commands within the transcripts.
Capability inventory: The skill uses ls, mkdir, and python3 to manage files, and dispatches multiple subagents (conversation-reviewer and sonnet-general-purpose) to process the data.
Sanitization: Absent. The transcript content is passed directly through a reduction script and then to LLM agents without filtering or sanitization.
[COMMAND_EXECUTION]: The skill executes local shell commands and scripts to manage the review process.
Evidence: Uses ls -t, head, and mkdir for file management.
Evidence: Executes a Python script located at ${CLAUDE_PLUGIN_ROOT}/scripts/reduce-transcript.py which is part of a prerequisite vendor plugin (ed3d-session-reflection).
[DATA_EXFILTRATION]: The skill accesses sensitive information by reading the user's complete Claude Code session history.
Evidence: Accesses ~/.claude/projects/ to locate and read JSONL session transcripts. While this is the intended purpose of the skill and the data remains within the local environment and agent context, it involves handling sensitive private data.

review-recent-sessions