The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands to analyze the local environment and project history. references/shared/change-analysis.md executes git status, git diff, and git log to scope code changes. references/shared/prompt-recovery.md executes grep, ls, and sqlite3 to search for data across the file system.
[DATA_EXFILTRATION]: The skill is designed to search and read sensitive session history and database files from global application storage locations outside the current project directory. It searches directories such as ~/.claude/projects, ~/.codex/sessions, ~/.continue/sessions, ~/.gemini/tmp, and VS Code global storage paths (e.g., ~/Library/Application Support/Code/User/globalStorage). It accesses state.vscdb (SQLite database) and .jsonl session logs to extract prompts and chat history from other AI tools like Cursor, Aider, and Windsurf.
[PROMPT_INJECTION]: The skill contains a surface for indirect prompt injection by ingesting untrusted data. Evidence: 1. Ingestion points: docs/lessons/, docs/articles/, and git diffs analyzed in references/shared/change-analysis.md. 2. Boundary markers: The instructions lack explicit delimiters or warnings to ignore embedded instructions in source documents. 3. Capability inventory: The skill has file system read access, shell command execution (git, grep), and database access (sqlite3). 4. Sanitization: There is no evidence of content validation or escaping for the ingested materials.

socials