The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to read sensitive agent transcript and session history files located in various hidden directories within the user's home folder, such as ~/.cursor, ~/.claude, and ~/.pi. These files contain detailed logs of user interactions and agent activities which may include private code or credentials.
[INDIRECT_PROMPT_INJECTION]: The skill processes 'shared records' from external and potentially untrusted sources including issue trackers, chat channels, and user reports. This content could be manipulated by an attacker to include malicious instructions aimed at influencing the agent's behavior during context reconstruction.
Ingestion points: Local transcript JSONL files and external data retrieved from issue trackers and chat channels (SKILL.md).
Boundary markers: The skill uses instructional constraints (e.g., 7-day range, project-specific scope) to limit the search but lacks formal delimiters to separate untrusted data from instructions.
Capability inventory: The agent is instructed to use file system commands (ls, grep), version control tools (git, gh), and invoke other skills like why and unslop.
Sanitization: The prompt includes a requirement to sanitize private context before any public output but provides no guidance on validating or sanitizing the input data retrieved from external sources.

recall