The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses and reads sensitive agent transcript files stored in platform-specific directories outside the immediate workspace root.
Evidence:
Instructions in SKILL.md to locate and read session logs from ~/.claude/projects/, ~/.cursor/projects/, ~/.pi/agent/sessions/, and ~/.codex/sessions/.
These files contain the full history of user interactions with AI agents, which is considered highly sensitive personal/professional data.
Context: The skill intends to use this data for personalization, but reading session logs across platform boundaries is a high-privilege operation.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted historical data (past chat transcripts) to generate new agent instructions, creating a risk that malicious patterns in the logs could be promoted into a permanent skill.
Ingestion points: JSONL transcript files containing chat history (Step 1 in SKILL.md).
Boundary markers: Absent; the skill does not specify how to distinguish between legitimate user preferences and potentially malicious or accidental instructions embedded in the chat logs.
Capability inventory: The skill uses create-skill for file creation and Git for committing/proposing changes (Step 4 and 6 in SKILL.md).
Sanitization: No sanitization or safety filtering is applied to the mined patterns before they are used to draft the final skill output.

automate-me