The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses and reads session logs from ~/.claude/projects/. These files contain a history of user interactions with the Claude agent, which may include sensitive code, business logic, or personal information. Although the data is primarily processed locally via the Claude CLI, reading these sensitive file paths constitutes a data exposure risk.
[COMMAND_EXECUTION]: The scripts scripts/mine_session_logs.py and scripts/score_ideas.py utilize subprocess.run() to invoke the claude CLI. While the execution uses argument lists (minimizing shell injection risks), it remains a dependency on an external binary to perform its core functions.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it incorporates untrusted data from session logs into LLM prompts. A malicious instruction previously recorded in a session log could influence the behavior of the idea extraction and scoring process.
Ingestion points: scripts/mine_session_logs.py reads external user messages from .jsonl logs in the ~/.claude/projects/ directory.
Boundary markers: The prompt template in _build_llm_prompt lacks robust boundary markers (e.g., XML tags or unique delimiters) to isolate user-provided samples from the system instructions.
Capability inventory: The skill uses subprocess.run to call the claude CLI in both mining and scoring scripts.
Sanitization: Content is truncated to 200 characters, but no escaping or structural validation is performed on the ingested text.

skill-idea-miner