The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements automated persistence and lifecycle management by installing shell hooks into .git/hooks/post-commit and the agent's configuration file at .claude/settings.json. These hooks are designed to execute Python commands automatically upon every git commit and at the start/end of every agent session.
[PROMPT_INJECTION]: The skill is susceptible to 'Indirect Prompt Injection' (Category 8) because its core functionality involves the ingestion and processing of untrusted external data, including chat transcripts from various agent platforms, git commit messages, and external documentation.
Ingestion points: Processes local logs from ~/.claude/, ~/.codex/, and ~/.pi/, as well as repository history and web-search results.
Boundary markers: While it uses structured markdown sections (Compiled Truth and Timeline), it does not implement explicit boundary delimiters to isolate instructions found within the mined data.
Capability inventory: The agent is granted the capability to write directly to the file system (to update the wiki) and install shell hooks.
Sanitization: No specific content sanitization or escaping is performed on the data before it is presented to the LLM for synthesis.
[PROMPT_INJECTION]: The skill adopts an 'apply-and-report' philosophy that instructs the agent to apply changes directly to the repository rather than proposing them for review first. Specifically, the documentation in references/comments.md states that comments received from the local web viewer are 'already approval' for edits, which may lead the agent to bypass standard human-in-the-loop safety checks for repository modifications.
[DATA_EXPOSURE]: To perform its mining functions, the skill accesses sensitive internal directories associated with AI agent platforms (~/.claude/, ~/.codex/, and ~/.pi/) to read private interaction transcripts. Although this is the primary purpose of the skill, it involves the systematic processing of the user's private session history.

repo-wiki