The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive local directories containing chat and session history, specifically ~/.claude/projects/, ~/.pi/agent/sessions/, and ~/.codex/sessions/. These transcripts may contain sensitive data, private code, or hardcoded secrets shared in previous interactions.
[COMMAND_EXECUTION]: The skill utilizes system commands and CLI tools, including git, gh (GitHub CLI), and grep, to inspect repository state, search histories, and verify pull request or issue statuses.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize untrusted data from chat transcripts, issue trackers, and PR descriptions, creating an attack surface for indirect prompt injection.
Ingestion points: Specified file paths for local transcripts and remote shared records (issues, PRs).
Boundary markers: The instructions do not specify the use of delimiters or markers to separate ingested data from agent instructions.
Capability inventory: The skill has read access to the filesystem and executes git/gh commands.
Sanitization: The skill relies on natural language instructions for the agent to "sanitize" output rather than technical validation or filtering of input content.

recall