The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The synchronization script scripts/sync_remote_sessions.sh is vulnerable to argument and option injection. The host variable $h is used directly in the rsync command line. If an attacker provides a host string containing SSH options (such as -oProxyCommand) or rsync flags, it can result in arbitrary command execution on the local system.
[DATA_EXFILTRATION]: The skill is designed to read and aggregate data from ~/.claude/projects, which contains the full plaintext transcript of all user interactions with the Claude Code agent. This represents a significant exposure surface for sensitive local user data and operational history.
[COMMAND_EXECUTION]: The documentation in SKILL.md encourages the user to establish a persistence mechanism by adding the synchronization script to a cron job for automated daily execution.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It ingests untrusted data from previous session logs (ingestion point: ~/.claude/projects/*.jsonl via extract_sessions.py) without sanitization or explicit boundary markers to delimit untrusted content. Malicious instructions embedded in historical chats could influence the 'Suggestions' and 'Patterns' generated by the AI. The presence of shell-executable scripts within the skill increases the potential impact of an agent following such injected instructions.

recap