The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to read conversation transcripts located at ~/.claude/projects/ to verify that the decision log matches the actual events of the session. This directory contains private chat history and potentially sensitive data disclosed during the conversation. While the skill includes instructions to avoid reading unrelated project logs, this relies on the agent's obedience to prompt-based constraints when accessing a sensitive directory.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from various sources (such as commit messages, file paths, and tool outputs) into its decision log and subsequently reads that log back during its "Audit" and "Cross-model review" phases, creating an attack surface for indirect injection.
Ingestion points: External strings are passed as arguments to scripts/log.sh and stored in decisions.tsv.
Boundary markers: The skill does not use specific delimiters or instructions to ignore embedded commands when the agent reads the log back for verification.
Capability inventory: The agent uses file-reading tools and has the capability to spawn subagent reviews based on the content of the log.
Sanitization: The scripts/log.sh script implements sanitization for spreadsheet formula injection characters (=, +, -, @), but it does not sanitize or filter the content for malicious natural language instructions.

show-me-your-work