The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes historical session logs which may contain untrusted data from previous runs (e.g., content fetched from the web), creating a surface for indirect prompt injection.
Ingestion points: scripts/session-search.py reads data from all .jsonl files in the ~/.pi/agent/sessions directory.
Boundary markers: The output includes metadata such as timestamps and roles, but it does not wrap the content snippets in explicit safety delimiters or "ignore" instructions.
Capability inventory: The skill is restricted to read-only operations on session logs and lacks network access, file-writing capabilities, or administrative privileges.
Sanitization: The script truncates content snippets to 300 characters and implements a hard byte cap for the total output, which helps mitigate potential large-scale injection attacks.

session-search