The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive local application data by reading session files. \n
Evidence: The script scripts/extract_prompt.py reads JSON files from ~/Library/Application Support/Claude/local-agent-mode-sessions/ (macOS) and the equivalent Windows path in AppData. These files contain private user session data, including chat history, metadata, and internal agent states, which are processed in memory and written to a local git repository.\n- [COMMAND_EXECUTION]: The script executes system commands using the subprocess module. \n
Evidence: It calls git for repository management and brew upgrade --cask claude to update the Claude application on the host system. While these are legitimate tools, the automated modification of system software as a side effect of a prompt tracking skill is a significant capability.\n- [PROMPT_INJECTION]: The skill exhibits a surface for Indirect Prompt Injection (Category 8). \n
Evidence: \n
Ingestion points: The agent reads and summarizes the systemPrompt extracted from local session files (which are untrusted external data).\n
Boundary markers: Absent. The instructions in SKILL.md (Step 2) do not include delimiters or warnings to ignore instructions found within the prompt being summarized.\n
Capability inventory: The skill has the ability to execute shell commands (git, brew) and modify local files.\n
Sanitization: Absent. The content extracted from the session files is processed as raw text without escaping or validation.\n- [EXTERNAL_DOWNLOADS]: The skill performs external software updates. \n
Evidence: It uses the Homebrew package manager to check for and install updates for the Claude for Mac application. Although this targets a well-known service, it involves downloading and executing third-party code on the host machine.

cowork-prompt-tracker