The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill is designed to search through and read sensitive local directories that typically contain authentication tokens, private prompts, and session metadata.
Evidence: Accesses paths such as ~/.claude/projects/, ~/.claude/history.jsonl, ~/.codex/sessions/, and ~/.pi/agent/sessions/.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from historical session transcripts which could contain malicious instructions designed to influence the agent's current behavior during the search process.
Ingestion points: Reads user and assistant text, tool-call arguments, and delegated-task prompts from historical JSONL files across various directories.
Boundary markers: The instructions direct the agent to "Search user and assistant text" but lack explicit instructions to treat the content as data only or to ignore embedded instructions found within the logs.
Capability inventory: The agent has access to system tools such as rg (ripgrep), jq, and pbcopy (to manipulate the system clipboard).
Sanitization: While the skill includes a privacy section to avoid reproducing secrets, it does not provide mechanisms to sanitize or ignore prompt injection patterns found in historical data.
[COMMAND_EXECUTION]: The skill prepares shell commands for the user to resume sessions, which are then placed into the macOS clipboard using pbcopy.
Evidence: Generates commands like vamos --resume <session-id>, letsgo resume <session-id>, and pi --session <transcript-path> using variables extracted from local logs.

session-discovery