The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses sensitive local directories including ~/.claude/projects/ and ~/.codex/sessions/. These session logs are known to contain sensitive information, including source code, environment variables, and potentially hardcoded API keys or tokens used during previous agent sessions.
[DYNAMIC_EXECUTION]: The pipeline specifies that the agent should "Write any helper code as throwaway scripts in the scratchpad" for inventorying files and analyzing traces. This involves the runtime generation and execution of code, which is a potential vector for unintended command execution if the generation process is influenced by malicious data.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted historical data from session traces which could contain malicious instructions from previous web browsing or tool outputs.
Ingestion points: Reads session trace files (.jsonl) from the user's home directory (~/.claude and ~/.codex).
Boundary markers: The skill does not define explicit delimiters or instructions for the agent to ignore embedded commands within the log files during ingestion.
Capability inventory: The skill possesses script execution capabilities (via the scratchpad) and the ability to spawn subagents, providing an execution path for injected instructions.
Sanitization: While the skill instructs subagents to redact secrets in their reports, there is no sanitization or validation of the raw data being ingested for analysis.

groundhog