The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the !command syntax in SKILL.md to automatically execute shell scripts when the skill is loaded by the agent. These commands access sensitive user directories including ~/.claude/projects/, ~/.codex/sessions, and ~/.grok/sessions to identify available transcripts.
[INDIRECT_PROMPT_INJECTION]: The primary purpose of this skill is to ingest and process historical conversation transcripts, which are considered untrusted data as they may contain past malicious prompts or instructions.
Ingestion points: Reads *.jsonl session files from ~/.claude/, ~/.codex/, and ~/.grok/ directories (defined in SKILL.md and references/stores.md).
Boundary markers: The skill instructs subagents to use an "untrusted-data preamble" stating that transcript content is data to analyze, not instructions to follow.
Capability inventory: The skill can propose edits to other skills, write to project memory, and modify standing rules.
Sanitization: Implements a strict human-in-the-loop requirement where all proposed changes must be reviewed and approved in a table format before application. It also explicitly forbids secrets or credentials from leaving the transcripts.
[DATA_EXFILTRATION]: The skill is designed to access and read session transcripts which frequently contain sensitive information, code, and project secrets. While the skill includes internal rules to prevent secrets from being quoted in proposals, the access to these files is inherently high-sensitivity.

distill-session