The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions direct the agent to access and process conversation transcripts stored in local filesystem paths, specifically ~/.claude/projects/ and ~/.codex/sessions/. It also utilizes the list_profiles command. While these actions are central to the skill's stated purpose of 'mining' user history to create a personalized mode, they involve the processing of private data that may contain sensitive information.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes 'transcripts' from past interactions as its primary data source. If a previous conversation contained malicious instructions designed to manipulate an agent, those instructions could be re-ingested during the mining phase and influence the resulting generated skill.
Ingestion points: Step 1 reads chat transcripts from ~/.claude/projects/ and ~/.codex/sessions/.
Boundary markers: The instructions lack explicit delimiters or 'ignore embedded instructions' warnings for the transcript data being processed.
Capability inventory: The skill has the capability to read files, write new skill files (via create-skill), perform git operations (commit, PR), and invoke other tools/subagents.
Sanitization: There is no mention of sanitizing or filtering the content of the transcripts before they are analyzed for patterns.

automate-me