The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted historical transcripts from multiple third-party agents, which serves as a potential vector for indirect prompt injection attacks.
Ingestion points: The session_reader.py script reads JSONL and SQLite database files from various tool-specific directories, such as ~/.claude/projects, ~/.cursor/chats, and ~/.agents/skills.
Boundary markers: The SKILL.md file contains a detailed 'Safety boundary' section instructing the agent to treat foreign content as untrusted inert history. The script additionally prefixes every line of recovered text (e.g., with |) to prevent transcripts from forging the reader's own headers.
Capability inventory: The skill possesses capabilities to read local files, access SQLite databases, and execute the zstd utility via subprocess calls.
Sanitization: The reader script uses unicodedata to strip control characters, filters out sensitive or high-privilege roles (system, reasoning, thinking), and enforces output prefixing to maintain a visual and structural boundary.
[COMMAND_EXECUTION]: The session_reader.py script executes the zstd utility to decompress Codex rollout files.
Evidence: In the _read_codex_jsonl function, subprocess.run([executable, "-dc", str(path)], ...) is called. The executable is resolved via shutil.which("zstd") and the path is validated against a restrictive regex ensuring it targets expected rollout filenames.

resume-foreign-session