The Agent Skills Directory

[DATA_EXFILTRATION]: The skill aggregates project memory from ~/.claude/projects/<project>/memory/, the brain/ knowledge vault, and skill definitions into a single file at /tmp/brain-snapshot.md. On multi-user systems, the /tmp directory is typically world-readable, which could expose sensitive project context, historical developer decisions, and internal logic to other users on the same machine.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from project notes and memory files, utilizing subagents to decide which files to delete, merge, or rewrite. Because the skill is configured to apply "high-confidence" changes autonomously, it is vulnerable to indirect prompt injection.
Ingestion points: Data is read from brain/ markdown files, CLAUDE.md, and project memory directories.
Boundary markers: The skill does not use explicit boundary markers or delimiters when feeding snapshots to subagents, nor does it instruct agents to ignore instructions embedded within the data.
Capability inventory: The skill possesses the capability to delete files, rewrite CLAUDE.md, modify skill definitions, execute shell scripts, and perform automated git commits.
Sanitization: No sanitization is performed on the ingested content. A maliciously crafted note could manipulate the Auditor or Reviewer subagents into suggesting the deletion of critical project files or the modification of instructions in CLAUDE.md to include malicious directives.
[COMMAND_EXECUTION]: The skill executes a local shell script (scripts/snapshot.sh) to concatenate files. While the script uses standard quoting to handle filenames with spaces, it operates on a set of files found on disk within the brain/ directory. If a malicious user can introduce files with specifically crafted names into the project, they might attempt to influence the execution or output of the snapshot process.

meditate