The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to read sensitive local chat history files located at ~/.claude/projects/<encoded-cwd>/<uuid>.jsonl. While these files are necessary for the skill's primary purpose of work recall, they contain the full history of user interactions and decisions.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from various external and potentially untrusted sources which could contain malicious instructions.
Ingestion points: Accesses chat transcripts (~/.claude/projects/...), issue trackers, chat/issue channels, long-form documentation, and error tracking systems via the why skill.
Boundary markers: No specific delimiters or "ignore embedded instructions" markers are defined for the ingested data; it relies on subagents to filter relevant regions.
Capability inventory: The skill utilizes git and gh CLI tools to verify project state and spawns subagents to process data.
Sanitization: The instructions mention sanitizing private context before public output, but do not specify sanitization or escaping of the ingested data to prevent indirect prompt injection.
[COMMAND_EXECUTION]: The skill executes shell commands and CLI tools to gather state.
Evidence: Uses ls -t to order transcript files by modification time.
Evidence: Utilizes git and gh (GitHub CLI) to verify the status of PRs, branches, and tickets.

recall