The Agent Skills Directory

[DATA_EXFILTRATION]: The skill's session history feature accesses sensitive AI agent conversation logs in directories like ~/.claude/projects/, ~/.codex/sessions/, and ~/.cursor/projects/. \n
Evidence: scripts/session-history/discover-sessions.sh and references/session-history.md define logic to scan these directories. The discovery phase touches session files from all projects managed by these agents on the host machine to identify relevant context for the current repo.\n- [INDIRECT_PROMPT_INJECTION]: The skill synthesizes untrusted historical session data, creating an attack surface for indirect prompt injection. \n
Ingestion points: scripts/session-history/extract-metadata.py and related scripts ingest raw session logs from multiple agent platforms. \n
Boundary markers: The session-historian.md subagent prompt lacks robust delimiters or 'ignore' instructions for the synthesized content. \n
Capability inventory: The skill can write new solution documents, edit shared vocabulary in CONCEPTS.md, and modify project instruction files (AGENTS.md/CLAUDE.md). \n
Sanitization: No sanitization is performed on the message content within logs before synthesis. \n
Evidence: references/agents/session-historian.md is a subagent that summarizes findings from extracted session logs. Malicious instructions in past conversations could be interpreted by the agent.\n- [COMMAND_EXECUTION]: The skill uses shell scripts for system-wide file discovery and metadata extraction. \n
Evidence: SKILL.md and references/session-history.md invoke bash and python scripts (e.g., discover-sessions.sh, extract-metadata.py) to process session logs and git information. \n- [EXTERNAL_DOWNLOADS]: The skill resolves and downloads external documentation and rules ('Compound Packs') via git.\n
Evidence: scripts/packs-resolve.py executes git clone to pull content from sources defined in .compound-engineering/config.yaml into a local cache.

ce-compound