The Agent Skills Directory

[DATA_EXFILTRATION]: Exposure of sensitive local conversation history. The skill discovers and reads session logs from ~/.claude/projects, ~/.codex/sessions, and ~/.cursor/projects. These files contain private technical discussions and may inadvertently include credentials or personal data shared during previous agent interactions.
[COMMAND_EXECUTION]: Local script execution and dynamic context injection.
Orchestrates a pipeline using bash and python3 to run internal extraction scripts (discover-sessions.sh, extract-metadata.py, etc.) on the user's file system.
Uses dynamic context injection (!git rev-parse ...) in SKILL.md to automatically execute shell commands for environment resolution when the skill is loaded.
Risk of command injection: The skill derives keywords from user input and appends them to shell command arguments in the discovery pipeline.
[PROMPT_INJECTION]: Indirect prompt injection via session history processing.
Ingestion points: Reads arbitrary text from previous session files (via extract-skeleton.py and extract-errors.py) which may contain untrusted data or malicious instructions from past interactions.
Boundary markers: Lacks explicit 'ignore embedded instructions' prompts when passing extracted history content to the synthesis subagent (ce-session-historian.md).
Capability inventory: The ce-session-historian.md persona can read and grep files, while the orchestrator uses shell commands.
Sanitization: Extraction scripts strip some system tags but do not sanitize natural language content for adversarial prompt patterns.

ce-sessions