The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs Python scripts by interpolating a user-provided keyword directly into a string literal (e.g., KEYWORD = '<KEYWORD>'). Although the instructions advise escaping single quotes, any failure or bypass in this sanitization logic allows an attacker to break out of the string and execute arbitrary Python code on the host system via the python3 -c command.
[DATA_EXFILTRATION]: The skill accesses highly sensitive session history files located in ~/.claude/projects/. These files typically contain source code, environment variables, authentication tokens used in past sessions, and private conversational data. By bringing this information into the agent's active context, it becomes vulnerable to exfiltration if the agent is later manipulated into making external network requests.
[PROMPT_INJECTION]: The skill introduces a surface for indirect prompt injection. It ingests historical log data that may contain content originally sourced from untrusted external entities (such as scraped websites or processed third-party files from previous sessions).
Ingestion points: Reads all .jsonl files within $HOME/.claude/projects/.
Boundary markers: Absent. The skill extracts raw text from historical messages without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill has access to the Bash and Read tools, and executes Python subprocesses.
Sanitization: Absent. The Python script performs no sanitization or filtering of the historical text content before it is internalised by the agent.

read-memories