The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses sensitive conversation transcripts and personal skill definitions to identify user preferences.
Evidence: It reads from ~/.claude/projects/<encoded-cwd>/*.jsonl to analyze historical interactions and .claude/skills/ to locate existing configurations.
Guardrail: The instructions include a specific privacy rule forbidding the use of global globs, ensuring that mining is restricted to the current workspace context only.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates data from conversation transcripts into the logic of newly generated skills.
Ingestion points: Transcript files in ~/.claude/projects/ containing arbitrary user and agent text.
Boundary markers: Not specified for the mining process.
Capability inventory: The skill can create or modify files, perform Git operations, and open Pull Requests.
Sanitization: No explicit sanitization or filtering is described for the patterns extracted from transcripts before they are used to draft the final skill.
[COMMAND_EXECUTION]: System commands are used to manage files and retrieve project metadata.
Evidence: The skill executes git log to identify when files were last modified and utilizes Git worktrees and commits to finalize changes.

automate-me