The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a shell command that interpolates a user-provided query: ~/.config/dotfiles/submodules/total-recall/.venv/bin/python .../retrieve.py "QUERY". If the user input is not sanitized, this allows for command injection attacks where an adversary could execute arbitrary code by including shell metacharacters (e.g., ;, |, `) in their search query.
[DATA_EXFILTRATION]: The skill accesses the file ~/.claude/session_memory.db, which contains a global history of all project sessions, past decisions, actions, and context. This constitutes a significant exposure of sensitive personal and professional data that could be exfiltrated if the agent is compromised.
[PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection.
Ingestion points: Historical transcript data is retrieved from the local session_memory.db database and loaded into the agent context.
Boundary markers: The skill instructions do not provide delimiters or instructions to ignore commands embedded within the retrieved transcripts.
Capability inventory: The agent has the capability to execute shell commands via the retrieve.py tool and read local files.
Sanitization: There is no evidence of sanitization or filtering of the retrieved transcript data before it is re-processed by the agent.

transcript-search