The Agent Skills Directory

[DATA_EXFILTRATION]: The script scripts/session-catchup.py accesses ~/.claude/projects/, an internal storage directory for the Claude application containing session history. It parses .jsonl files to extract and display previous user and assistant messages. This constitutes access to sensitive application data (conversation history) that is not typically exposed via standard tool APIs.
[COMMAND_EXECUTION]: The skill defines a Stop hook that executes shell and PowerShell scripts (check-complete.sh, check-complete.ps1) from the plugin's installation directory. Additionally, the instructions in SKILL.md direct the agent to execute the session-catchup.py Python script to perform context recovery.
[INDIRECT_PROMPT_INJECTION]: The 'Session Catchup' mechanism ingests data from past conversations stored in .jsonl files. This creates an attack surface where instructions present in previous sessions could be reintroduced into the current context without sanitization.
Ingestion points: scripts/session-catchup.py reads data from ~/.claude/projects/.
Boundary markers: Absent; the recovered context is printed to the agent's input stream without explicit delimiters or 'ignore' instructions.
Capability inventory: The skill utilizes Bash, Write, and Edit tools which could be abused if the agent follows instructions from recovered context.
Sanitization: Absent; the script extracts and displays raw message content from history files.

planning-with-files