The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides bash command templates for searching history files using grep. Specifically, the instruction grep -l "<search_term>" ~/.claude/projects/*/history.jsonl interpolates a user-supplied search term directly into a shell command. This creates a surface for command injection if a user provides a query containing shell metacharacters (e.g., ;, |, or backticks) to break out of the quoted string and execute arbitrary commands.
[DATA_EXFILTRATION]: The skill explicitly targets sensitive application directories, specifically ~/.claude/projects/, to read history.jsonl and MEMORY.md. These files contain raw, unencrypted transcripts of all previous user interactions and extracted facts, which constitutes an exposure of private conversation data and session metadata.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from past conversation logs, creating a vulnerability to indirect prompt injection.
Ingestion points: Conversation transcripts stored in history.jsonl and structured memory in MEMORY.md located within the ~/.claude/projects/ path.
Boundary markers: The skill instructions do not specify any delimiters or safety markers to prevent the agent from following instructions that may be embedded within the recalled historical data.
Capability inventory: The skill utilizes shell commands (find, grep) and general file read capabilities to process the data.
Sanitization: There is no mechanism described for sanitizing or escaping the recalled content before it is re-integrated into the agent's active context.

recall