The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process session transcripts from ~/.claude/projects/. These logs contain records of all previous interactions, including data retrieved from external sources or untrusted files in prior sessions. An attacker could potentially embed malicious instructions in a file or website that, when recorded in the logs, might influence the agent's behavior during a subsequent retrospective.
Ingestion points: Session log files (.jsonl) located in the user's home directory (~/.claude/projects/...).
Boundary markers: No explicit delimiters or instructions are used to treat the log content as untrusted data within the prompt context.
Capability inventory: The skill can read files, execute its own Python scripts, and suggest changes to the project's configuration files (e.g., AGENTS.md, CODING_STANDARDS.md).
Sanitization: The scripts/digest_sessions.py script attempts to mitigate risk by redacting passwords, tokens, and API keys using regex, and by truncating user messages to 400 characters.
[DATA_EXPOSURE]: The skill explicitly targets sensitive session transcripts in ~/.claude/. These transcripts contain full history of the agent's work, which may include sensitive code, internal configurations, or data processed during tasks. Although the skill is intended for retrospectives, this access constitutes a significant exposure of sensitive data to the model.
[COMMAND_EXECUTION]: The skill's instructions require the agent to execute a local script using python -X utf8 -I scripts/digest_sessions.py. While the script is part of the skill package and uses the -I (isolate) flag for better security, this pattern demonstrates the agent performing shell-level operations on local files.

retro