The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill indexes local session transcripts from ~/.claude/projects and ~/.codex/sessions to provide search capabilities. While these transcripts contain sensitive conversation history, the skill includes a robust redaction engine (clean_text in scripts/recall.py) that identifies and masks secrets such as API keys, private keys, and passwords before indexing or transmitting any data.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill can sync session data to a remote service if the user configures RECALL_URL. This communication is hardened against common attack vectors: it rejects HTTP redirects to prevent SSRF, validates that URLs use HTTPS or localhost, and enforces strict 0600 (owner read-only) permissions for sensitive configuration and token files.
[INDIRECT_PROMPT_INJECTION]: As the skill processes and re-reads historical transcripts, it possesses a surface for indirect prompt injection. Malicious instructions encountered and logged in a previous session (e.g., from a website the agent read) could be retrieved and influence the agent's behavior in a future session.
Ingestion points: Local transcripts in ~/.claude/projects and ~/.codex/sessions.
Boundary markers: The skill does not use specific delimiters for retrieved text, relying on the agent to treat results as informational evidence.
Capability inventory: SQLite database operations, network communication (sync), and local command execution (rg, git, grep).
Sanitization: Automatic redaction of secrets from all ingested and displayed text.
[COMMAND_EXECUTION]: The skill executes local utilities including ripgrep (rg), grep, and git to search transcripts and identify project context. It also uses setsid and nohup to run the indexer as a background process to avoid blocking the user experience.

recall