The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill accesses and reads chat transcripts stored in the user's home directory at ~/.claude/projects/. These files contain a comprehensive record of the user's past interactions, which may include sensitive code, project context, and private discussions. While necessary for the skill's 'recall' function, this involves access to a sensitive local data store.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from untrusted external and historical sources, creating a surface for indirect prompt injection.
Ingestion points: Reads ~/.claude/projects/*.jsonl files and integrates findings from the why skill, which searches source control, issue trackers, and chat channels.
Capability inventory: The skill can read local files, execute shell commands (e.g., ls, grep), and use git and gh to interact with remote repositories.
Boundary markers: The instructions do not define clear delimiters or specific isolation for the content of the transcripts or external records to prevent instructions within those records from overriding the agent's behavior.
Sanitization: While it mentions sanitizing private context for public output, it does not provide mechanisms to validate or sanitize the input data against malicious instructions.
[COMMAND_EXECUTION]: The skill executes shell commands such as ls -t and grep to search through chat history and uses CLI tools like git and gh to verify the current state of PRs, branches, and tickets.

recall