The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses local AI session history files located in ~/.claude/projects/, ~/.codex/sessions/, ~/.cursor/projects/, and ~/.pi/agent/sessions/. These files contain full conversation history, tool outputs, and potentially sensitive project or user information. This data is extracted, summarized, and transmitted to GitHub as issue comments. While this is the core intended functionality, it presents a risk of exposing private session content if not carefully reviewed by the user.
[COMMAND_EXECUTION]: The skill executes multiple local scripts and CLI tools to perform its tasks. It uses git and gh (GitHub CLI) for repository operations and issue management. It also invokes internal Python and Bash scripts (e.g., discover-sessions.sh, validate-doc-claims.py, and extract-errors.py) to process logs and validate documentation claims. The validate-doc-claims.py script specifically uses subprocess.run() to interact with the local git environment to verify paths and commit SHAs.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests untrusted data from both external sources (GitHub issue comments) and internal sources (session history logs). This data is processed by subagents to generate documentation and suggest automated edits to project instruction files (AGENTS.md, CLAUDE.md) and the domain vocabulary file (CONCEPTS.md).
Ingestion points: The skill reads GitHub issue comments using gh api and parses local session history logs (.jsonl files) using scripts in the scripts/session-history/ directory.
Boundary markers: The instructions specify the use of fenced YAML blocks and specific markers (), but these delimiters do not provide robust isolation from adversarial instructions that might be present in the processed text.
Capability inventory: The skill has the capability to write to GitHub issues, create or modify local documentation files, and execute shell commands through its validation scripts.
Sanitization: While the skill employs semantic assessment and subagent reviews, it lacks strict syntactic sanitization or escaping mechanisms to prevent adversarial instructions within ingested data from influencing the agent's subsequent actions or edits.
[EXTERNAL_DOWNLOADS]: The skill references the official GitHub CLI installation URL (https://cli.github.com) as a prerequisite. This reference targets a well-known and trusted service for standard development tooling and does not contribute to an elevated risk verdict.

compound