The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides shell commands to dynamically determine the repository structure and session state. It uses git rev-parse and pwd to locate the root of the codebase and ls with tr to find the most recent session log file.
[DATA_EXFILTRATION]: The skill accesses sensitive internal application paths to provide context for generated documents. It references session logs in ~/.claude/projects/ and temporary files in /private/tmp/, which contain session transcripts and application state.
[PERSISTENCE]: The skill modifies the local repository configuration by updating .git/info/exclude. This ensures the _agent/ directory remains untracked by Git across sessions, maintaining a local state that persists between clones.
[INDIRECT_PROMPT_INJECTION]: The skill defines a storage system for documents that could be used to ingest untrusted data into the agent's context in future sessions.
Ingestion points: Working documents written to <repo-root>/_agent/docs/ as described in SKILL.md.
Boundary markers: The skill suggests using Markdown H1 headers and italicized session metadata blocks to separate notes, though it lacks explicit "ignore instructions" warnings.
Capability inventory: The skill has capabilities for shell command execution (git, ls, mkdir) and file system writes.
Sanitization: There is no automated sanitization or escaping of the content written to the working documents.

worknotes