The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes history logs from multiple AI tools (Codex, Claude, Cursor, OpenCode). These logs contain arbitrary text from previous sessions, including user prompts and tool outputs, which constitute untrusted data that could influence subsequent agent behavior.\n
Ingestion points: scripts/history.py reads data from local directories such as ~/.codex/sessions, ~/.claude/projects, and SQLite databases like store.db via the json_records, parse_cursor_db, and parse_opencode_db functions.\n
Boundary markers: The script does not utilize explicit boundary markers in the generated JSON output to distinguish between session data and metadata.\n
Capability inventory: The script performs local file reads and writes. It does not perform network operations or execute arbitrary shell commands.\n
Sanitization: The prompt_text function in scripts/history.py implements a filter to discard strings containing potential prompt injection markers such as <system-reminder>, <rules>, or # AGENTS.md instructions.\n- [DATA_EXFILTRATION]: The skill accesses sensitive local chat history and telemetry files from multiple development tools to aggregate them into a single file.\n
Evidence: scripts/history.py targets specific application paths including ~/.codex/sessions, ~/.claude/projects, ~/.cursor, and ~/.local/share/opencode.

spine-history