The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs shell command execution for environment context and validation.
It uses dynamic context injection (!command syntax) in SKILL.md to execute git rev-parse --abbrev-ref HEAD for branch detection.
It executes a bundled Python script scripts/validate-frontmatter.py to ensure the parser-safety of generated YAML frontmatter.
[DATA_EXPOSURE]: The skill is designed to access and process sensitive user data.
The ce-session-historian persona is instructed to read and synthesize user session history files from standard agent locations (e.g., ~/.claude/projects/, ~/.codex/sessions/). While this is central to the skill's functionality for 'compounding' knowledge, users should be aware that these logs may contain PII or secrets from prior conversations.
The ce-best-practices-researcher persona probes for existing skills in the user's home directory (e.g., ~/.claude/skills/**/SKILL.md) to discover available capabilities.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8).
Ingestion points: The skill ingests untrusted data from current conversation history and externalized session history provided by the ce-sessions skill.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when interpolating the extracted session data into the final documentation drafts.
Capability inventory: The orchestrator has the capability to write files to the project directory, including creating CONCEPTS.md and modifying core instruction files like AGENTS.md or CLAUDE.md.
Sanitization: The skill includes a validate-frontmatter.py script that validates the YAML syntax of generated files, but it does not perform semantic sanitization of the prose content for malicious instructions.
[EXTERNAL_DOWNLOADS]: The researcher subagents (ce-best-practices-researcher and ce-framework-docs-researcher) use WebSearch and WebFetch to gather information from the internet. This is standard behavior for research-oriented personas and does not involve the execution of untrusted remote code.

ce-compound