The Agent Skills Directory

[DATA_EXPOSURE]: The skill is designed to access and read sensitive personal data located in local directories including the user's Claude Code transcripts (~/.claude/projects) and personal Obsidian vault notes. This exposure is central to the skill's primary purpose of generating a self-portrait based on a user's own corpus. The data is aggregated into a temporary file at /tmp/reflection-corpus.md for analysis.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection because it ingests untrusted data from external sources (chat history and personal notes) and processes them through an LLM to answer sensitive questions.
Ingestion points: The reflection_corpus.py script reads JSONL transcripts from the agent's project directory and markdown files from the Obsidian vault.
Boundary markers: The generated digest uses basic Markdown headers and horizontal rules as separators, which may not be sufficient to prevent the LLM from obeying instructions embedded within the processed text.
Capability inventory: The skill has access to Bash, Read, and Write tools, which could be abused if an injection is successful.
Sanitization: The script performs basic cleaning of technical noise and metadata but does not specifically sanitize or escape content to prevent prompt injection.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local Python script (reflection_corpus.py) which performs file system traversal and aggregation. While the script uses the standard library and performs no network operations, executing local scripts with user-controllable arguments (like the --vault path) involves a layer of command interaction.

reflection