The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The Stop hook in SKILL.md utilizes pwsh -ExecutionPolicy Bypass and powershell -ExecutionPolicy Bypass. This explicitly circumvents the PowerShell Execution Policy, a security feature intended to prevent the unauthorized execution of scripts.
[CREDENTIALS_UNSAFE]: The session-catchup.py script programmatically accesses ~/.claude/projects/ to read and parse session history logs stored as .jsonl files. These logs contain the full history of previous interactions and tool outputs, which constitutes access to sensitive application data and private user history.
[INDIRECT_PROMPT_INJECTION]: The skill represents an indirect prompt injection surface by ingesting and processing data from historical session logs and project files.
Ingestion points: session-catchup.py reads historical JSONL logs, and the PreToolUse hook reads task_plan.md from the current working directory.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the retrieved historical context or file content as data rather than instructions.
Capability inventory: The skill utilizes Bash, Write, and Edit tools, which can be leveraged for significant system impact if an injection occurs.
Sanitization: The session-catchup.py script performs no sanitization or filtering of the text content extracted from session logs before presenting it to the agent's context.
[COMMAND_EXECUTION]: The skill makes extensive use of local script execution in its hooks and documentation, including python3, bash, and powershell calls. The session-catchup.py script also takes a user-influenced directory path ($(pwd)) as an argument, which could be exploited if not properly handled by the underlying shell.

planning-with-files