The Agent Skills Directory

[PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by design.
Ingestion points: It recursively scans and reads session transcripts stored as JSONL files in ~/.claude/projects/ across multiple projects.
Boundary markers: The skill lacks delimiters or explicit instructions to ignore potentially malicious content embedded in the session transcripts being processed.
Capability inventory: Content extracted from these logs can be promoted to persistent instructions by modifying CLAUDE.md or other skill definitions in ~/.claude/skills/ via Edit and Write tools.
Sanitization: There is no evidence of sanitization or filtering to prevent malicious instructions in session logs from being adopted as new rules or skill updates.
[COMMAND_EXECUTION]: The skill executes shell commands via Bash to interact with the Linear CLI.
Evidence: In SKILL.md, the instruction ~/.claude/skills/linear/scripts/linear issue create --title "..." --description "..." uses data extracted directly from session logs (user_corrections or errors).
Risk: If the session data contains shell metacharacters or command sequences, it may lead to command injection, especially since the agent is directed to execute these commands silently in the final step.
[DATA_EXFILTRATION]: The skill exercises broad read access to sensitive local data.
Evidence: The skill uses find and Python logic to parse the contents of all .jsonl session logs in the user's Claude project directory.
Risk: While the intended use case is local analysis, this capability allows the agent to aggregate and process sensitive conversation history across all projects from the filesystem.

retrospective