The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions specify reading session transcripts from local application paths (e.g., ~/.claude/projects/). Accessing these logs is the primary mechanism for the skill's "cross-session reading" feature, but it involves reading sensitive application data from the local filesystem.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from the agent's full session history, which can contain untrusted content such as code or data from external sources.
Ingestion points: SKILL.md identifies that the agent reads full session transcripts, including questions, attempts, and errors.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are defined to separate the session data from the agent's own instructions.
Capability inventory: The skill is restricted via disable-model-invocation: true and contains self-imposed restrictions against writing code or sending instructions to the main agent, which significantly mitigates the impact of potential injections.
Sanitization: There are no mentioned mechanisms for sanitizing, escaping, or filtering the session content before it is processed.

mentor