The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to read sensitive local directories and files in the user's home directory. These paths contain private conversation history and potentially configuration metadata from various AI tools.
Evidence includes access to: ~/.claude/projects/, ~/.codex/sessions/, ~/.pi/agent/settings.json, and ~/.zcode/cli/db/db.sqlite.
Accessing settings files like ~/.pi/agent/settings.json and SQLite databases poses a risk of exposing credentials or session tokens stored within these platform configurations.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted historical data from past conversation logs, creating a vulnerability surface where malicious instructions in those logs could influence the agent's current behavior.
Ingestion points: Raw dialogue is retrieved via trellis mem search, extract, and context commands as described in SKILL.md and references/cli-quick-reference.md.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' warnings to prevent the agent from accidentally executing instructions found within the retrieved dialogue.
Capability inventory: The skill grants the agent the ability to execute shell commands (via the trellis mem tool) and encourages updating critical project files such as prd.md, design.md, and project-wide specifications.
Sanitization: There is no requirement or guidance for the agent to sanitize, validate, or filter the historical content before 'absorbing' it or using it to modify files.

trellis-session-insight