The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/history.py executes the ripgrep (rg) utility using subprocess.Popen. The command is constructed as a list of arguments, which prevents shell injection. The script specifically uses the --no-config and -F (fixed strings) flags to ensure predictable and safe search behavior.
[DATA_EXFILTRATION]: The skill discovers and reads chat history data from local directories including ~/.claude/projects, ~/.codex/sessions, ~/.grok/sessions, and Cursor databases (state.vscdb). While these paths contain sensitive user information, the access is inherent to the skill's primary function of history recovery. The script performs these operations locally and does not contain any network operations for exfiltration.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted chat logs that could contain malicious instructions designed to influence the agent.
Ingestion points: scripts/history.py reads .jsonl, .vscdb (SQLite), and .json files from discovered chat history paths.
Boundary markers: The decode function identifies "injected" content by checking for specific system-level prefixes such as <environment_context>, # AGENTS.md instructions, and <task-notification>.
Capability inventory: Use of ripgrep via subprocess.Popen for search operations in scripts/history.py.
Sanitization: Results are limited to literal matches and are returned in a structured NDJSON format to prevent the agent from misinterpreting the data as active commands.

chat-history