The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive local directories containing user session histories and chat transcripts for multiple AI assistants and IDEs.
Evidence: The skill defines access to paths including ~/.pi/agent/sessions/, ~/.claude/projects/, ~/.codex/sessions/, ~/.cursor/acp-sessions/, ~/.grok/sessions/, and ~/.local/share/opencode/opencode.db.
Evidence: The skill checks for delivery status and logs in vendor-specific capture directories: ~/.joelclaw/capture/.
[DYNAMIC_EXECUTION]: The skill instructions include a JavaScript-based execution pattern using executor_execute to dynamically discover and invoke tools at runtime.
Evidence: The "Executor Code Mode" section provides a template that uses tools.search to find tool paths and then executes them via tools[recallTool.path] based on query results.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process raw transcript data and session history, which are untrusted sources that may contain malicious instructions from prior interactions.
Ingestion points: Transcript files in ~/.pi/, ~/.claude/, ~/.codex/, ~/.cursor/, ~/.grok/, and ~/.local/share/opencode/.
Boundary markers: The instructions advise citing session IDs and line windows, but do not specify robust delimiters or sanitization techniques to prevent the agent from obeying instructions embedded in the historical content.
Capability inventory: The skill has access to executor_execute, session_search, session_context, session_inspect, and session_chunks to process this data.
Sanitization: No explicit mention of sanitizing or escaping the retrieved transcript content before it is processed by the agent.

session-search