The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes historical session transcripts which serve as an attack surface for indirect prompt injection. Malicious instructions embedded in past conversations (e.g., from reading a malicious repository in a previous session) could be re-activated when the historian retrieves and summarizes that history.
Ingestion points: The skill reads raw JSONL interaction logs from ~/.claude/projects/.
Boundary markers: There are no robust delimiters or specific instructions to treat retrieved message content as untrusted data, increasing the risk that the agent may follow instructions found in the history.
Capability inventory: The skill uses DuckDB for indexing and provides the agent with the ability to read all past messages and write summaries to the local filesystem at ~/.claude/kaizen/session-summaries/.
Sanitization: The implementation lacks any content filtering, escaping, or sanitization of user messages extracted from the JSONL records before they are returned to the agent context.
[DATA_EXFILTRATION]: The skill accesses sensitive filesystem paths including ~/.claude/projects/ and ~/.claude/kaizen/. These directories contain private interaction history, verbatim user messages, and metadata about the user's projects. While this access is essential for the skill's purpose, it represents exposure of sensitive interaction data.

session-historian