The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses sensitive local directories containing user interaction history, including ~/.claude/projects, ~/.pi/agent/sessions, and ~/.codex/sessions, as well as configuration directories like ~/.agents/skills.
Evidence: The instructions explicitly search these paths to mine behavioral patterns and update existing workflow modes.
Mitigation: The skill includes guardrails requiring the agent to only access paths where the user has granted access and mandates confirmation before reading session content.
[COMMAND_EXECUTION]: The skill utilizes shell commands to interact with the local environment.
Evidence: Uses git log -1 --format=%cI <path> to determine when a skill was last edited for incremental mining.
Mitigation: The command is localized to metadata retrieval and does not involve complex pipe chains or remote source execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from session transcripts, which could contain adversarial instructions intended to be codified into the agent's persistent behavior modes.
Ingestion points: Transcripts and session logs located in ~/.claude/projects, ~/.pi/agent/sessions, and ~/.codex/sessions (SKILL.md).
Boundary markers: Absent; there are no explicit delimiters or instruction-ignore markers defined for the mined content.
Capability inventory: The skill uses the skill-creator workflow to write new instructions to disk and can perform Git operations (commit, push, PR) at the user's request (SKILL.md).
Sanitization: The skill implements an "overfitting" check that requires patterns to be seen in at least two separate slices of history before codification, which provides a basic filter against one-off malicious inputs.

capture-workflow