The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use standard system and development utilities, including ls -t for time-ordered file discovery, grep for pattern searching within logs, and git and gh (GitHub CLI) to verify the current state of branches, pull requests, and issues.
[DATA_EXFILTRATION]: The skill accesses sensitive local chat transcripts stored in the ~/.claude/projects/ directory. These files contain previous interactions and workspace state. While this access involves sensitive local data, it is the primary intended function of the 'recall' skill, and the instructions explicitly require the agent to sanitize private context before generating the final output.
[INDIRECT_PROMPT_INJECTION]: The skill operates on an indirect prompt injection surface by ingesting and processing data from external, untrusted sources such as issue trackers, git logs, and shared project documentation.
Ingestion points: Local chat history files at ~/.claude/projects/, git repository logs, GitHub CLI outputs, and external documentation sources.
Boundary markers: The skill does not define specific text delimiters but relies on pinning the temporal window (default 7 days) and specifying the workspace scope to limit the ingestion of unrelated data.
Capability inventory: The agent can execute file system searches (ls, grep), version control operations (git), platform API calls (gh), and spawn subagents to process the data.
Sanitization: The instructions mandate the use of the unslop skill for final formatting and explicitly command the agent to sanitize private context before any public output is generated.

recall