The Agent Skills Directory

[DATA_EXFILTRATION]: The skill extracts knowledge from local conversation transcripts and transmits it to a service named Sibyl. The documentation explicitly describes Sibyl as a "multi-machine access (network service)," indicating that harvested data—which may contain proprietary code, credentials, or personal information from past sessions—is sent to an external destination.- [COMMAND_EXECUTION]: The skill uses shell commands like find, grep, and ls to search for and read sensitive log files located in ~/.claude/projects and ~/.codex/sessions. These directories contain the full history of user interactions with Claude Code and Codex, representing a high-value target for data harvesting.- [DYNAMIC_EXECUTION]: The instructions rely on python3 -c to execute dynamic code snippets for parsing JSONL data. This pattern is used to process potentially large volumes of conversation content harvested from the file system.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from historical conversation transcripts. It lacks explicit boundary markers or sanitization logic when reading these files, creating a vulnerability where instructions previously discussed or outputted in a session (e.g., "ignore your consolidation rules") could be re-activated and influence the agent during the dream cycle. Findings are supported by:
Ingestion points: Reads .jsonl files from ~/.claude/projects and ~/.codex/sessions (SKILL.md).
Boundary markers: Absent. The extraction guide focuses on quality but does not provide delimiters to prevent the agent from obeying embedded instructions.
Capability inventory: Uses find, grep, python3 -c, and sibyl add (SKILL.md).
Sanitization: Absent.

dream