The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive local file paths containing full agent chat transcripts and session logs.
Evidence: Reads from ~/.claude/projects/<slug>/<uuid>.jsonl and ~/.codex/sessions/<yyyy>/<mm>/<dd>/rollout-*.jsonl.
Context: These files contain raw interaction history, which may include sensitive project data, hardcoded secrets previously discussed, or environment details.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from various external sources to rebuild context, creating an injection surface.
Ingestion points: Ingests content from source control history, issue trackers (GitHub), and shared error records, as well as historical transcripts in SKILL.md.
Boundary markers: There are no instructions provided to use delimiters or ignore embedded instructions within the processed data.
Capability inventory: The skill has capabilities to read files, execute git and gh commands, and spawn subagents for processing data.
Sanitization: While the skill instructs to sanitize private context for public output, there is no mention of sanitizing or validating input data to prevent the agent from following instructions embedded in the external records.
[COMMAND_EXECUTION]: The skill executes local CLI tools to gather agent activity and project state.
Tools used: list_agents, get_agent_activity, paseo, git, gh, and list_profiles.
Subagent spawning: Uses pstack-explorer to spawn subagents for parallel processing of transcripts.

recall