The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to read and process sensitive conversation logs stored at ~/.claude/projects/. These logs contain the full history of user interactions, which may include credentials, environment variables, or private data.
[DATA_EXFILTRATION]: The script scripts/export.py is vulnerable to path traversal. The --project-path and --session-id arguments are used to construct a file path without validation, which could allow a malicious actor or a compromised session to force the script to read any .jsonl file on the filesystem using .. sequences.
[COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script (scripts/export.py) with arguments derived from the current session context. This execution is used to process sensitive system files.
[EXTERNAL_DOWNLOADS]: The installation instructions recommend fetching the skill from the author's repository via npx skills add HartreeWorks/skill--save-conversation.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it processes untrusted data from previous conversations. Evidence:
1. Ingestion points: Conversation log files (.jsonl) located in ~/.claude/projects/ (processed by scripts/export.py).
2. Boundary markers: Absent; the script parses the JSON structure but does not include explicit delimiters or instructions for the agent to ignore embedded commands within the extracted content.
3. Capability inventory: The agent has the ability to execute shell commands and perform file operations (File: SKILL.md).
4. Sanitization: The script performs basic sanitization such as slugify for filenames and shift_headings for Markdown content, but does not sanitize the message content for potential injection attacks or malicious instructions.

save-conversation