The Agent Skills Directory

[DATA_EXPOSURE]: The skill reads sensitive user conversation data from local directories, specifically ~/.codex/sessions/, ~/.codex/archived_sessions/, and ~/.claude/projects/. These files contain full transcripts of user interactions with AI agents.
[DATA_EXFILTRATION]: Verbatim user messages are extracted from private logs and included in the body of GitHub Pull Requests created by the skill via gh pr create. This process transmits potentially sensitive information from local logs to an external platform (GitHub).
[COMMAND_EXECUTION]: The skill makes extensive use of system commands, including git (branching, committing, pushing) and gh (creating and auto-merging pull requests). It specifically uses gh pr merge --squash to automatically land changes to the repository under specific conditions.
[EXTERNAL_DOWNLOADS]: The skill executes npx skills update, which downloads and runs external code from the NPM registry to refresh meta-skills.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data (past conversation logs) and allows that data to influence its core logic, including writing new instructions to SKILL.md files and pushing those changes to a repository.
Ingestion points: Reads transcripts from ~/.codex/sessions/, ~/.claude/projects/, and HTML artifacts from .briefs/ directories across configured projects.
Boundary markers: The instructions lack explicit boundary markers or "ignore embedded instructions" warnings when the agent is directed to "read each kept conversation end-to-end."
Capability inventory: The skill can write to the filesystem (modifying SKILL.md files), execute Git commands (commit, push), and manage GitHub Pull Requests (create, merge).
Sanitization: There is no evidence of semantic sanitization or filtering of the ingested conversation data to prevent embedded instructions from influencing the agent's audit behavior.
[DYNAMIC_EXECUTION]: The skill executes internal Python scripts (scripts/list_conversations.py and scripts/list_briefs.py) to process logs and manage state cursors.

skill-improver