The Agent Skills Directory

[DATA_EXPOSURE]: The skill uses a script scripts/session_ingest.py to search for and read sensitive user information from the home directory. Specifically, it targets ~/.claude/projects/ and ~/.skill-studio/sessions/ to extract chat transcripts and session history. While this is part of the tool's core functionality for ingesting prior sessions, it exposes private conversation data to the agent's context.
[COMMAND_EXECUTION]: The skill relies on the execution of local Python scripts (scripts/session_ingest.py and scripts/eval_sweep.py) to perform its primary tasks. These scripts are invoked via the shell, which is a standard pattern for this type of tool but represents a local execution surface.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, creating an attack surface for indirect prompt injection.
Ingestion points: The skill reads external "gold-set" Q&A pairs, large user datasets/corpora, and session transcripts parsed by the ingest script.
Boundary markers: There are no explicit instructions or delimiters mentioned to prevent the agent from following instructions embedded within the processed datasets or transcripts.
Capability inventory: The agent has the ability to execute shell commands (eval_sweep.py), write files to the local repository (.rag-eval/), and perform network searches via external tools (tavily-search, firecrawl-research).
Sanitization: The provided session_ingest.py script uses regex for signal extraction but does not perform sanitization of the text content before it is passed to the agent.

rag-eval