The Agent Skills Directory

[DATA_EXFILTRATION]: The skill reads sensitive local chat transcripts stored in ~/.claude/projects/ to extract user working conventions. While the skill implements a guardrail to limit access to the current workspace, processing these transcripts exposes private communication history to the agent's logic. The extracted data is then used to generate content that may be sent to a remote repository via a Git pull request.
[INDIRECT_PROMPT_INJECTION]: The ingestion of untrusted transcript data creates a vulnerability surface for indirect prompt injection.
Ingestion points: Chat transcript files (.jsonl) located in ~/.claude/projects/<encoded-cwd>/ as specified in SKILL.md.
Boundary markers: The skill does not define explicit delimiters or instructions for subagents to ignore potentially malicious instructions embedded within the mined transcript content.
Capability inventory: The skill has the ability to write files (via the plugin-dev:skill-development skill) and perform Git operations such as creating worktrees, commits, and pull requests.
Sanitization: There is no mention of sanitization, filtering, or validation of the transcript content to prevent instructions from past conversations from influencing the skill drafting process.

automate-me