The Agent Skills Directory

[DATA_EXFILTRATION]: The scripts/session-catchup.py script accesses sensitive directories in the user's home folder (~/.claude/projects/ and ~/.codex/sessions/) to read agent session logs. This allows the skill to expose the full history of previous interactions, which may contain sensitive data, private information, or credentials discussed in past sessions.- [PROMPT_INJECTION]: The skill introduces a surface for indirect prompt injection through its session catchup mechanism. By extracting and re-injecting past conversation content into the active context, the agent could be influenced by malicious instructions or data (e.g., from web content or tool outputs) that were present in a previous session.
Ingestion points: scripts/session-catchup.py reads JSONL session logs from platform-specific storage paths in the home directory.
Boundary markers: The script output does not include explicit delimiters or instructions to the agent to ignore embedded commands in the recovered history.
Capability inventory: The skill utilizes shell and PowerShell scripts for file management, directory resolution, and integrity hashing across task_plan.md, findings.md, and progress.md.
Sanitization: The catchup script does not sanitize or escape the content of the messages retrieved from the history logs before presenting them to the agent.- [COMMAND_EXECUTION]: The skill relies on the execution of multiple local scripts across different environments (Python, Bash, and PowerShell) to perform its core functions. These include init-session, attest-plan, check-complete, and set-active-plan, which manage the file-based state and project configuration.

planning-with-files