The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses sensitive local directories containing session transcripts, specifically ~/.claude/projects/ and ~/.codex/sessions/. These logs contain interaction history, source code, and terminal output which may include sensitive information. The skill includes a mandatory redaction step to mitigate the exposure of secrets and API keys.
[COMMAND_EXECUTION]: The skill relies on executing shell pipelines involving find, xargs, stat, perl, jq, and awk to filter and format log data. These commands interact directly with the local file system and process data extracted from logs.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from previous session logs. If a past session recorded malicious content (e.g., an attacker-controlled file containing instructions), those instructions could be re-injected into the agent's context during the distillation process.
Ingestion points: Reads from ~/.claude/projects/*.jsonl and ~/.codex/sessions/*.jsonl in Step 1 and 2.
Boundary markers: Not explicitly defined for the subagent prompts processing the log batches.
Capability inventory: Ability to read files via jq, execute shell formatting via perl/awk, and generate suggested improvements for the user.
Sanitization: Implements mandatory redaction for secrets (Step 5) and uses structured field extraction via jq rather than full file ingestion.

distill-sessions