The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted historical data which may influence its synthesis of new benchmarks (Indirect Prompt Injection surface).
Ingestion points: Conversation archives in conversations/ and session transcripts from ~/.claude/projects/ (referenced in SKILL.md).
Boundary markers: Absent; historical text is processed without explicit isolation markers or "ignore embedded instructions" warnings.
Capability inventory: Performs filesystem reads of history, executes gbrain CLI tools, and writes new evaluation files to the skills/ directory (documented in SKILL.md).
Sanitization: The skill mandates a privacy scrub to replace sensitive names and companies with placeholders before staging files.
[DATA_EXFILTRATION]: The skill accesses sensitive user interaction history stored in local directories and hidden application folders (~/.claude/). While the skill performs local writes rather than direct network exfiltration, the processing of sensitive history logs constitutes a data exposure risk.
[COMMAND_EXECUTION]: The skill invokes local gbrain CLI commands (gbrain search, gbrain query, gbrain transcripts) to retrieve data from history. These commands are gated by the skill's internal logic and target local substrates.

skill-autobench