The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to read sensitive local data, specifically agent chat transcripts located at ~/.cursor/projects/<slug>/agent-transcripts/<uuid>/<uuid>.jsonl. While this is the intended purpose of the 'recall' functionality, it involves accessing private interaction history.
[INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection because it is instructed to ingest data from untrusted external sources such as user reports, issue trackers, and chat channels.
Ingestion points: Local JSONL transcript files and external records fetched via the 'why' skill.
Boundary markers: The instructions do not define clear delimiters or escaping mechanisms to prevent the agent from obeying instructions that might be embedded within the retrieved chat history or issue reports.
Capability inventory: The skill utilizes git, gh (GitHub CLI), and standard file system commands like ls to verify the state of the workspace.
Sanitization: While the skill includes an instruction to 'sanitize private context before any public output,' it lacks instructions to sanitize or validate incoming data from external sources to prevent command or prompt injection.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands such as ls -t, git, and gh to verify the current state of the project and its history.

recall