The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs the gjalla command-line tool from a public registry using pipx install or uv tool install as part of the onboarding process.
[COMMAND_EXECUTION]: The instructions direct the agent to execute several shell commands, including environment detection (command -v), package installation, and multiple tool-specific commands (gjalla setup, gjalla auth, gjalla sync, gjalla memory) to manage the platform's state.
[DATA_EXFILTRATION]: The skill is designed to collect and upload data to the gjalla.io service. This includes reading session transcripts from internal agent directories (~/.claude/projects/ and ~/.codex/sessions/) and extracting commit history and project documentation. While the skill instructs the agent to filter out secrets and personal data, it represents a structured mechanism for sending local agent history to a remote service.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it requires the agent to read and process content from potentially untrusted project files and command outputs.
Ingestion points: Reads data from README.md, CLAUDE.md, AGENTS.md, git log output, and files within ~/.claude/projects/ or ~/.codex/sessions/.
Boundary markers: No explicit boundary markers or "ignore instructions" delimiters are used when processing these external data sources.
Capability inventory: Uses gjalla memory add and gjalla attest add to transmit extracted information to a network endpoint, and gjalla setup to modify local configuration files.
Sanitization: The skill relies on natural language instructions for the agent to manually identify and exclude secrets or personal information; it does not implement programmatic sanitization or validation of the ingested content.

gjalla-onboard