The Agent Skills Directory

[DATA_EXPOSURE]: The skill accesses conversation transcripts stored in JSONL format at ${CLAUDE_CONFIG_DIR:-$HOME/.claude}/projects/<encoded-cwd>/*.jsonl. These files contain historical interactions that may include sensitive project details, personal information, or credentials shared in past sessions. While the skill limits its scope to the active workspace, the ingestion of full chat history is a significant exposure of user data.
[COMMAND_EXECUTION]: The skill performs several shell operations to facilitate its workflow, including:
Executing git log to check history.
Running a local Node.js script: node <plugin>/skills/reflect/scripts/claude-project-dir.mjs to resolve project directories.
Using git worktree, git commit, and pull request operations to save the generated skills.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its mining process.
Ingestion points: Reads untrusted conversation history from JSONL files in the project directory.
Boundary markers: No specific delimiters or instructions are provided to the subagents to ignore potentially malicious content within the transcripts.
Capability inventory: The skill has the ability to write new executable instruction files (SKILL.md) and perform Git operations (commit/PR).
Sanitization: There is no mention of filtering or sanitizing the content mined from transcripts before it is incorporated into the newly drafted skill, meaning malicious payloads in past chats could influence the behavior of the resulting personalized profile.

automate-me