The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from Claude Code session history, creating a surface for indirect prompt injection attacks.
Ingestion points: The script scripts/preprocess.mjs reads .jsonl session log files from the ~/.claude/projects/ directory and writes an extracted transcript to a temporary file.
Boundary markers: The prompt template in references/analysis-prompt.md lacks strict delimiters or specific instructions for the sub-agent to ignore instructions embedded within the transcript data.
Capability inventory: The skill can execute shell commands (node, rm) and utilizes sub-agents to invoke the skill-creator tool, which has the capability to modify local skill files.
Sanitization: While the preprocessor filters certain message types, it does not sanitize or escape the content of the transcript to prevent embedded instructions from affecting the sub-agents' behavior.
[COMMAND_EXECUTION]: The skill executes local shell commands to facilitate its workflow.
Evidence: SKILL.md invokes node ${CLAUDE_SKILL_DIR}/scripts/preprocess.mjs to extract data and rm <transcript_file> to clean up temporary files created during the process.

skill-retro