The Agent Skills Directory

[DATA_EXPOSURE]: The skill instructs the agent to access local directories containing sensitive internal state and session history from various AI agent platforms.
Targeted sensitive paths include ~/.claude/projects, ~/.codex/sessions, and ~/.pi/agent/sessions.
These directories contain raw JSONL traces of agent sessions, which typically include user prompts, tool outputs, project file paths, and potentially PII or hardcoded secrets.
[DATA_EXFILTRATION]: The skill provides explicit workflows to transmit harvested local agent state and session logs to an external repository on Hugging Face.
The instructions provide commands like hf upload <namespace>/<repo> ~/.codex/sessions codex/<project-or-cwd> --type dataset to perform the exfiltration.
[COMMAND_EXECUTION]: The skill utilizes npx -y to download and execute the @huggingface/hub package at runtime.
Pattern: npx -y @huggingface/hub upload datasets/<namespace>/<repo> ./local/parquet-folder data.
While the package itself is from a well-known service, the use of npx -y introduces a dependency on remote package availability and execution during the upload workflow.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it is designed to ingest, search, and filter data from external datasets that could contain malicious instructions.
Ingestion Points: The skill reads data via /rows, /search, and /filter endpoints of the Dataset Viewer API.
Boundary Markers: The skill includes an Anti-Patterns section that warns the agent not to treat external content or tool responses as trusted instructions.
Capabilities: The agent has access to the network and the local filesystem, creating a risk if it obeys instructions embedded within a processed dataset.
Sanitization: No explicit code-level sanitization of dataset content is provided beyond the textual warning to the agent.

huggingface-datasets