The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions direct the agent to read sensitive local files, specifically chat transcripts located at ~/.cursor/projects/<slug>/agent-transcripts/<uuid>/<uuid>.jsonl. While these files contain private user interactions, accessing them is the primary and stated purpose of the skill. The skill documentation includes an explicit requirement to 'sanitize private context before any public output' to mitigate exposure risks.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes untrusted historical data.
Ingestion points: Reads project transcripts from ~/.cursor/projects/.
Boundary markers: The skill uses a 'fan-out' approach with subagents to process slices of the corpus, providing structural isolation, though specific delimiters for the content itself are not defined.
Capability inventory: Uses ls, grep, git, and gh to verify state and search history.
Sanitization: Explicitly instructs the agent to sanitize context before producing public output and uses an external skill (ps-unslop) to process the final brief.

ps-recall